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Description 

The present invention relates to regulating usage of 
a computer database. More particularty. the invention re- 
lates to techniques for preventing unauthorized use of 
an electronic digital information database and for meas- 
uring the utilization of the database by authorized users. 

Information conveyed in electronic form is rapidly 
becoming the most valuable of commodities. Electronic 
digital databases now exist for a variety of different ap* 
plications and fields of endeavor, and many businesses 
presently rely heavily on their ability to access those da- 
tabases. 

The value of being able to instantaneously, electron- 
ically access important, accurate information cannot be 
overestimated. Many of our daily activities depend on our 
ability to obtain pertinent information in a timely fashion. 
While printed publications and electronic mass media to- 
gether fulfill most of the average person's informational 
needs and most often are the only source for fuil-text 
erence information, just about any effort to access infor- 
mation can benefit from the vast infomnation handlingca- 
pabiiities of the computer In today's fast-paced world, 
we quickly come to insist on and rely upon the most thor- 
ough and up-to-the-minute information available *• often 
made possible only by electronic data processing and 
informational management technology. On-line, public 
databases, now a two billion dollar a year industry, are a 
case in point. 

As the 'information explosion" continues its course, 
more and more people will become dependent on elec- 
tronically-stored information and people will continue to 
be willing to pay premium prices (when necessary) for 
access to and use of such Information because of its use- 
fulness and value to them. Currently, the pnrtcipat re- 
source for large, electronic information data bases are 
on-line (public) data base services such as Dialog Infor- 
mation Services, Mead Data Central. Dow Jones Infor* 
mation Services, Source. Compuserve, and many oth- 
ers. Most on-line data bases are abstract and/or biblio- 
graphic in content, and many are used primarily to ac- 
cess the document locations of specified information, 
rather than for the recall of the original document full-text. 

Historically, personal computers have been used 
primarily for word-processing, modeling, and, to a lesser 
extent, the structured data base management of records. 
Technology that enables the user of, for example, a per- 
sonal computer to search for, locate, and retrieve topi- 
cally related full-text information from vast full-text data 
bases would be extremely useful and valuable. 

The only viable way to make some kinds of informa- 
tion (e.g.. information which must be constantly updated) 
available is to maintain centralized databases and permit 
users to access the centralized databases through tele- 
phone lines or other communk:ation means. Until very 
recently, this method has been the most cost-effective 
way to offer access to electron k: databases. Access to 
a centralized database can be controlled relatively eas- 



ily, and users can be charged for usrng a centralized da- 
tabase tn accordance with parameters which are rela- 
tively easy to measure (i.e., the amount of time the user 
(S connected to the database computer, the number and 
5 type of tasks the user requests, etc. ). Moreover, because 
the database never leaves the central computer (each 
user is typically given access to only small portions of 
the database at a time), there is no danger of someone 
making unauthorized copies of the database. 
10 However, centralized databases have important dis- 
advantages. For example, it takes a relatively long time 
to manipulate information in a centralized database due 
to the relatively slow data transmission rates of standard 
communications channels and because the centralized 
IS database computer typicalfy shares its resources among 
hundred or thousands of users at once. This can be a 
serious drawback if the user wishes to access a large 
volume of information or wishes to periorm particularty 
complex data manipulation tasks. Also, it may take a long 
20 time during periods of peak database usage before com- 
munk:atk>n can be successfully established with a cen- 
tralized database computer, decreasing the utilization of 
the database and causing some users to become frus- 
trated. Further disadvantages include the expense of es- 
2S tablishing k?ng-<jistance communications paths (e.g., 
WATS telephone line maintenance charges, long-dis- 
tance direct-dial telephone charges, satellite channel 
costs, etc.) between distant user terminals and the cen- 
tral database computer, and the reliability problems as- 
30 sociated with such communications paths. Moreover, the 
centralized computer facility needed to handle the ac- 
cess requests of many distant users simultaneously is 
extremely expensive to purchase and maintain 

With the advent of cheaper computer hardware and 
3S new, high density information storage devices (such as 
the optical disk and the bubble memory). It has become 
practk:al to give users their own copies of large and com- 
plex databases and permit users to access and manip- 
ulate the databases using their own computer equip- 
40 ment. Optk^al disks are capable of storing vast amounts 
of information at relatively tow cost, are small enough to 
be sent throu^ the mails, and can provide data at ex- 
tremely rapkd rates. Bubble memory devices provide 
some similar capabilities. 
^ CD and related digital disk drives can currently store 
up to 225. CXX) pages of full-text tnformatbn per remova- 
ble disk and can inexpensively maintain in excess of 
1 ,800,000 pages of text simultaneously on-line. These 
technologies are ideal for personal computer information 
so base libraries. CD drives use removable compact disks 
(essentially tienttcal to an audio compact disk) the very 
low cost and anormous storage capacity has been pre- 
dicted to result in an installed base of as large as one 
million drives to 10 million drives (including non-CD but 
ss related optical storage technotogy) by the end of 1990. 
Owners of 'CD-BOM' and related drives will create an 
enormous demand for both lexical software and elec- 
tronically published informatton base products. Mitsubi- 
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Shi Research Institute of Japan, for example, estimates 
that between 8,000 and 12.000 different CO-ROM pub- 
lication titles will be on the nriarket by the end of 1990. 

Hence, it is now possible to store some databases 
on transportable, high<lensity information storage devic- 
es, and simply mail each user his own copy of the data- 
bases. The user can in this way be given exclusive ac- 
cess, via his own computer system, to local, on-site da- 
tabases. Rapid access time is provided because access 
to the databases is exclusive rather than shared, and be- 
cause data can be read from the database storage de- 
vice by local high-speed t/O devices and transmitted 
over local high-speed I/O channels or networks. The 
stored databases can be updated periodk;ally If neces- 
sary by sending the user storage devrces containing a 
new version of (or new portkans of) the databases. 

it is very expensive to buHd a database. One way to 
recover the costs of constructing and maintaining a da- 
tabase ("Return On Investment*, or ROI) is to charge a 
flat subscription or access fee to each user subscribing 
to use the database. If this »s the onfy billing method 
used, however, infrequent users of the database may be 
discouraged from subscribing, because they would be 
asked to pay the the same cost a frequent user pays. 
Thus, many database owners charge subscribers a 
nominal subscription fee, and then periodically (e.g.. 
monthly) charge users a fee cateulated in accordance 
with the anrtount the user has used the database. 

While it is easy to measure the amount someone 
uses a centralized database (e.g.. simply time each ac- 
cess sesskxi length and store the time informatkxi with 
user identificatkjn informatkxi), there is no convenient 
way to measure the usage of a database residing on a 
user's own computer, or to convey such usage informa- 
tkxi to the owner of the database. Technk^ues are known 
forautomatcally, electronically measuring consumptwn 
of a commodity such as electricity, water or gas, storing 
the measurements in a memoiy devce, and periodically 
down toading the stored measurements over a telephone 
line to a central billing computer. Unfortunately, these 
known technques are not readily adaptable to database 
usage metering, and moreover, are neither secure 
enough nor provkje the security against database piracy 
that most database owners dennand 

The preventkxi of unauthorized database usage be- 
comes a hugs problem whenever a stored database 
leaves the possesson and control of the database own- 
er. Computer program manufacturers tose millions of 
dollars each year to •pirates' who make unauthorized 
copies of software and distribute those copies for profit. 
Complex databases are often even more expensive to 
produce than programs, so that potential contributors of 
data base properties, as well as database owners thenrv 
selves. may be extremely hesitant to permit electronk: 
copies of their properties or databases to leave their con- 
trol unless they can be absolutely sure no unauthorized 
copies will be made. The copyright laws and contractual 
licensing agreements may deter, but will not prevent, un- 



authorized use and copying of databases 

WO-A-fl5/03584 teaches the use of encryption and 
distributed keys to protect access to information stored 
at a customer site. However, the document does not dis- 
5 close stonng a database In encrypted form The docu- 
ment also fails to teach stonng budget limit Information, 
nor does it teach the testing of stored metered informa- 
tion to determine whether a budget defined by stored lim- 
it Information will be exceeded (or any further limits 
based on such testing). The document does not propose 
setting a limit of maximum quantity usage and^or 
processing allowed for database information. In the doc- 
ument, if the necessary keys are present so as to permit 
access, the usage is permitted only until the register is 
'5 filled. Because of these and other shortcomings, the sys- 
tem disclosed in the document is Insufficient to protect 
database contents distributed to a user site. 

WO-A-88/02202 falls under Article 54(3). and is 
therefore not relevant to the question of Inventive step. 
20 This reference discloses establishing an online connec- 
tion (e.g., over telephone lines) between a centralized 
authorization terminal and a customer data retrieval ter- 
minal to authorize file access by the customer terminal. 
The authorization process is performed remotely at the 
2S central temiinal. Because this reference relies upon real 
time involvement of a central site, its approach is essen- 
tially impractk:al and uncompetitively expensive when 
compared with applicant's inventon both for a large 
number of users and for many applteations. Importantly, 
30 the reference also doesnl provkJe any teaching to locally 
protect and/or secure the metering process, and does 
not teach any way by whkih the user can access stored 
'credit* infomnation. The reference also fails to teach that 
the informatk)n stored in a history storage unit or debit 
^ register shoukj be encrypted, nor does It teach applying 
physically secure techniques for protecting such infor- 
mation. Accordingly, for these and other reasons, the 
system taught by the reference is not as practical and 
secure, for many applicatksns, as the system provided 
^ by the applicant. 

SUMMARY OF THE INVENTION 

The present inventk)n provides a database access 
45 system and method at a user site which permits author- 
ized users to access and use the database and abso- 
lutely prevents unauthorized database use and copying. 
The present invention also provides a facility for meas- 
uring usage of the on-site database for the purpose of 
^ billing the user according to the amount he has used the 
database, and for perwdically conveying the measured 
usage information to the database owner (or his agent) 
- while preventing the user from tampering with the 
measured usage informatk)n. 
^ The inventbn solves fundamental media based 
electronic publishing issues including: 

Security of the information base. The present inven- 



3 



EP 0 329 681 B1 



tion provides a code/decode Interlock System which 
includes both software and a tamper proof hardware 
module that prevents unauthonzed and/or unme- 
tered use of a protected information base. The 
present invention also supports a multi-level coded s 
security access system limiting access to various 
portions of a data base only to those individuals pos- 
sessing the proper security code(s); and 



2, Greatly enhance the ultimate market penetration 
of CD published products by making CD publica- 
tions affordable to a much large body of customers: 
and 

3. Produce higher ultimate revenues per published 
disk from those customers who would otherwise 
have purchased a costlier version of the database 
product. 



Ascertaining the degree of usage of the information 
base. The present invention stores, in one of several 
alternative fomns of non-volatile memory, the dates 
and times that any files (or documents, sections, 
properties, etc.) are accessed and also reconls the 
amount of information read from each file into mem- 
ory by the user 

With the present invention, a CD-ROM disk, for ex- 
ample, might contain alt issues of 10 separate publica- 
tions {technical, medical, business, etc.) goina back for 
five years. Each publisher would be able to set the price 
for the use of its publk;at(on or publkialkDns and each 
publisher could then receive a 'copyright royalty* re- 
tum-on-investment based on the actual customer usage 
of the publishers' products. Therefore, publishers con- 
tributing more important, popular or costly to devekjp lex- 
ical informatkDn base properties could earn revenues 
commensurate with the market demands and pricing 
strategies for their products. 

The present invention eliminates the necessity of 
determining how much of the net revenue of a CD infor- 
mation base product each contributing publisher shouW 
receive (currently an issue of considerable concern to 
publishers). The present invention also ensures the data 
security of information bases - a critkial, frequently 
voiced, and previously unanswered problem causing 
conskjerable publisher anxiety. It woukl be quite diffk:ult 
(requiring a high level of specialized expertise and costly 
high-powered computers) to "break" the hardware/soft- 
ware data security system provided by the present in- 
vention and copy material without being charged an ap- 
propriate fee. 

Publishers can license their products at an excep- 
tionally low initial cost to customers (i.e. for a $25.00 in- 
itial fee instead of a $1 ,000.00 or more annual fee). Low 
initial lk;ensing fees wouU result from the usage auditing 
capability of the present inventkxi and woukJ allow new 
clients to experiment with the product at little or no risk. 
Similarly, customers who antcipate a low level usage of 
a given information base product may find the bwer 
costs of a usage based fee schedule a practical and af- 
fordable justification to acquire a product that would oth- 
envise not be purchased. 

In sum. the present invention will: 

V Significantly accelerate market penetratkxi of 
electronically published products due to substan- 
tially tower initial license costs; 



10 The security protection provided by the present in- 
vention will give publishers significant advantages in se- 
curing exclusive contracts for important publishing infor- 
mation base properties, since the invention provides the 
information base property contributors with: 

IS 

1. Vastly superior copy protection security; 

2. Ultimately greater revenue; 

3. Publisher specific control over pricing; and 

4. A retum-on-investment commensurate with the 
20 market demand for their information base property. 

In accordance with one important feature of the 
present inventkxi. a storage medium stores the data- 
base in encrypted form, and also stores index informa- 
2S tion whch correlates portions of the encrypted database 
with index keys. The index informatkyi may itself be en- 
crypted if desired. A host digital signal processor opera- 
tively connected to the storage rnedium is prepro- 
grammed so as to generate a database access request. 
30 read the index information from the storage medium, 
identify (in accordance with the index information) the 
portions of the encrypted database which satisfy the ac- 
cess request, and read the identified encrypted database 
portions from the storage medium. 
3S A secure decoder control ksgic device coupled to the 
host processor receives the encrypted database por- 
tions read by the host processor, decrypts portions of the 
encrypted database read by the host processor to pro- 
duce corresponding decrypted information, and trans- 
^ mits the decrypted information back to the host proces- 
sor. The decoder control k^gk; devkie also measures the 
quantity of usage of and/or other parameters pertaining 
to the informaton decrypted by the decrypting device, 
and stores these measurements in a non-volatile (and in 
^ many cases tamperproof ) memory devce. The invention 
thus provdes a detailed record of database usage - in- 
cluding a breakdown of usage of each file or 'property' 
stored on a local storage medium. Additk>nal decryption 
of database informatkyi can be prevented or disabled if 
so more than a certain percentage of a database (or more 
than a specified contiguous portion of a database) has 
been copied by the user as an additional safeguard pre- 
venting unauthorized copying. 

The system may further include means for prevent- 
^ ing tampering with the memory devk:e and/or the decod- 
er control logic means. 

In accordance with another important feature of the 
present invention, database usage infonnatron is stored 
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at a user's site and is periodically communicated to a 
central billing facility. For example, the non-volatile mem- 
ory device storing data indicating database usage may 
be housed in a replaceable module. Periodically, the 
user disconnects the module from his computer system s 
and sends it to a centralized billing facility. At the central- 
ized billing facility, the contents of the memory device are 
read and used to bill the user according to his database 
usage. 

In accordance with yet another important aspect of io 
the present invention, communications is periodically es- 
tablished between the user's sit&and a central facility for 
the purpose of telecommunicating database usage infor- 
mation stored at the user's site to the central facility. 

In accordance with yet another important feature of is 
the invention, the user is automatically prevented from 
decrypting the encrypted database after a predeter- 
mined event occurs (e g/, "expiration' of a memory mod- 
ule, or excessive database usage indicating copying at- 
tempts) unless the user has implemented an "anttdote' 20 
(e.g., inputted secret informattori into his computer sys^ 
tern and/or installed a replacement component). 

Because the database is stored in encrypted form 
(and/or the database directory is encrypted or otherwise 
coded), the only way to obtain usefuf database informa- 2S 
tton is to decrypt portions of it using the tamper-proof de- 
crypting means of the invention. Safeguards may thus 
be used to prevent unauthorized database decryption. 

Thus, the present invention resolves several funda- 
mental problems that would othenwise impede the rate 30 
of growth of the CD-ROM and COI electronic publishing 
markets. For example, it is a costly process to create the 
core properties that may be incorporated into an infor- 
mation data base, and the structuring of the data base 
itself may, in some circumstances, be a costly effort. One 35 
way for data base preparers to recover the costs of con- 
structing and maintaining a database is to charge a fiat 
subscription or access fee to each user subscribing to 
use the database. If this is the only billing method used, 
however, infrequent users of the database may be dis- 40 
ecu raged from subscribing - because they would be 
asked to pay the same cost a frequent user pays. Fur* 
thermore, potential users may be hesitant to pay a sig- 
nifk:ant one time or initial fee to acquire a technology or 
product with which they are unfamiliar 45 

With the present tnventkyi, a user will be able to pay 
(if so structured by the data base provkder) according to 
his usage of the product and both the perceived risk, as 
well as ~ in lower usage environments ~ the high cost 
of the use of the technology, can be reduced or eliminat- so 
ed. Furthermore, since the present invention shoukd ac- 
celerate the installed base and revenue growth rate for 
a given product, it may enable costs for even the high 
volume users to drop as welt. 

Moreover, database use can be measured simply by ss 
measuring the quantity of information which is decrypt- 
ed. Other parameters relating to database usage (e.g., 
which databases and/or database subdiviskxis have 



been used: and the time, date and duration of use of each 
database and/or subdivision) may also be monitored and 
stored. The stored usage information can be periodically 
communicated to a centralized facility for billing the user 
in accordance with hts database usage, Moreover, the 
user's on-site database access system can be designed 
to cease functioning unless the user installs a new com- 
ponent and/or inputs 'secret" information - and the cen- 
tralized facility can provide the user with such replace- 
ment components and/or secret information only when 
the user has paid his bill. 

Because the invention provides a detailed record of 
which literary properties have been used and how much 
each property has been used, use payments paid by the 
user may be fairly apportioned to the property owners 
according to actual use of their respective properties For 
example, if a user licenses a storage medium storing a 
library containing hundreds of different literary properties 
and then uses only two properties in the library, the own- 
ers of those two properties can be paid substantialty-all 
of the licensing fees charged to the user 

A free market system is thus maintained in an envi- 
ronment not oth^erwise susceptible to free market com- 
petrtk>n. Publishers and authors can be assured that they 
will receive incomes based on customer demand for their 
properties, and publishers can retain absolute control 
over pricing despite the fact that the properties are being 
distributed on a storage medium atong with hundreds of 
other properties. 'Best sellers' can still be distinguished 
from unpopular worths, and authors can be paid royalties 
based on consumer demand for their works. 

This invention thus solves the fundamental CD and 
Optical publishing problem of how to provide end-users 
with disk libraries containing many different publications 
from different venders. Different properties from different 
publishers have differing significances in today's market- 
place. These products have prices which each reflect 
vendor investment, product specific market demand, 
and other vendor product marketing considerations. The 
present invention allows each vendor to set a price for 
their product(s) carried on CD or other media publica- 
tions. The invention has an interlock system that pre- 
vents access to the non-volatile storage media (such as 
a CD-ROM disk) unless the user has contracted for the 
use of the disk and has a hardware plug-in module in- 
corporating software. 

When a customer makes use of stored data, the in- 
vention monitors which files are accessed and how much 
information is requested by the user to be displayed. In 
one embodiment of the present invention, information 
that is being reviewed or browsed may be distinguished 
from infomnation that is read into a host computer for the 
purpose of copying, modifying, or telecommunicating, 
with different cost rates being applied to the different ac- 
tivities (so that, for example, the cost of browsing can be 
much less than the cost of copying or printing). Depend- 
ing on the specific applk;atron and the nature of the user 
contract, the user might be required to: 
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1 Telephone the publisher once every three months, 
establishing a modem link over which a request is 
transmitted to telecommunicate back to the pub- 
lisher the meter usage data: or 
2. Mail to the publisher once every three months a 
removable EPROM module that contains the 
metered usage data. 

The present invention thus prevents copying or 
browsing of a protected information base without ade- 
quate compensation to the publisher and its infonmation 
base property (data) suppliers. Each supplier of informa- 
tion to an information base product receives a return on 
investment that reflects both the market demand for his 
specific property and the pricing and other marketing 
strategies that the supplier deems appropriate for his 
product. 

The present invention allows very large numbers of 
customers to acquire library disks at very low initial costs, 
since the customer's billing can be largely based on us- 
age, not simply possession of the library disk. As a result, 
potential customers, regardless of size or financing, will 
be able to maintain very broad based libraries on-site. If 
a given group regularly uses only a fraction of the infor-^ 
mation base, the group's users can still search the entire 
data base whenever appropriate. This means that most 
user billing is concentrated on those reference resources 
that the users frequently use. but an entire, cpmprehen* 
sive reference library extending beyond the user's fre- 
quent requirements is immediately available for use. A 
publisher will be in a much better position to provide large 
scale reference information base libraries. In many ap- 
plications, the breadth and comprehensiveness of these 
encyclopedk: libraries will encourage much more fre- 
quent use and a much larger body of users. 

The present inventran thus answers both the needs 
of a potentially very targe customer base for low cost in- 
itial access to comprehensive digital disk based refer- 
ence libraries, while at the same time maintaining pub- 
lisher control over prictng and guaranteeing an appropri- 
ate return on investment based on the customer's de- 
mand for their products. 

The invention may be particularly attractive to the 
owners of the leading properties in a given vertical pub- 
lishing market, since these owners are likely to be par- 
ticularly sensitive to the issues of unauthorized access 
to and copying of their product, pricing of their product, 
and equitable return on the value of the contributk)n of 
their product to an information base library. These pub- 
lishers are likely to greatly increase their revenues 
through participation in library publication and distribu- 
tion in accordance with the present invention » and the 
presence of such publishers in the marketplace will make 
it economicatty necessary (and feasible) for other pub- 
lishers who have second tterproperties to contribute to 
the same information base product. 

The present invention may also include an optional 
security system which allows an organization to prevent 



usage of all or a portion of an information base unless 
the user enters his security code. Multiple levels of se- 
curity codes can be supported to allow restriction of an 
individual's access according to his security auihonza- 

s tion level. 

There is significant value in using the present inven- 
tion with certain types of non full-text information t>ases 
For example, an electronic, CD disk containing compre- 
hensive telephone white pages, telephone yellow pages, 

10 and as additional options, individuai specific additional 
information (including estimated income level, publica- 
tions received, job type and position, social security 
number, and other information that is compatible and le- 
gally available from one or more of the various mailing 

'5 list companies) might be used with the present invention. 
As a result of the present invention, the telephone 
operating companies providing directory listings can be 
compensated on the usage of their data base, while the 
mail order companies can also receive a revenue stream 

20 based on both usefulness of their data bases to custom- 
ers and the extent of customer usage of their informal k)n 
The present inventkxi provides, for the first time, a con- 
text in which firms such as telephone operating compa- 
nies and other informatksn property suppliers can safety 

2S and profitably supply informatkDn for desk-top electronic 
information base products. 

BRIEF DESCRIPTION OF THE DRAWINGS 

30 These and other features and advantages of the 
present invention will be better and more completely un- 
derstood by referring to the following detailed description 
of preferred embodiments in conjunction with the ap- 
pended sheets of drawings, of which: 

3S 

FIGURE 1 is a schematic block diagram of a pres- 
ently preferred exemplary embodiment of a data- 
base usage metering and protect k>n system in 
accordance with the present invention; 
40 FIGiJRE 2 is a schematic block diagram of the infor- 
mation stored in the storage medium block shown 
in FIGURE 1; 

FIGURE 3 is a more detailed schematic block dia- 
gram of the decoder/billerbkxjk shown in FIGURE 1 : 
4S FIGURES 4a-4b are together a flow chart of the 
steps performed by the system shown in FIGURE 1 : 
and 

FIGURE 5 is a schematic block diagram of a further 
presently preferred exemplary embodiment of a 
so database usage metering and protection system in 
accordance with the present inventk)n. 

DETAILED DESCRIPTION OF PREFERRED 
EMBODIMENTS 

55 

FIGURE 1 is a schematic block diagram of a pres- 
ently preferred exemplary embodiment of a database us- 
age metering and protection system 10 in accordance 
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with the present invention. System 10 includes three 
main blocks: a storage medium block 100, a host com- 
puter 200. and a decoder/biller block 300. 

Predefined database(s) is (are) stored on storage 
medium 1 00 in encrypted fonm, and selective portions of s 
the database (s). are read from the storage medium by 
host computer 200 (several different databases can be 
stored on the same medium, although the present inven- 
tion in its simplest form uses only a single stored data- 
base which may contain multiple files, segments, 'prop- JO 
erties" or the like). Host computer 200 may be a compu- 
ter dedicated to the task of accessing the stored data- 
bases, but need not be (for example, the host computer 
can be a general-purpose digital computer used to do a 
variety of different tasks). is 

Decoder/biller block 300 is connected-to host com- 
puter 200, and performs at least two important functrons, 
Decoder/biller 300 decrypts portions of the stored data* 
bases on a user-need basis (e.g., after confirming the 
user has proper authority to access the databases). De- 2a 
coder/bilter 300 atso meters database usage, and gen- 
erates usage infomnation in a form whk:h can periodically 
be conveyed to the owner of the databases (or his agent, 
e.g., a service company). The usage information is typ^ 
ically used to cateulate a database access fee the user 2S 
is to be charged. 

Decoder/biller bkxk 30O may take the form of a 
hardware unit (or card) electrk:ally connected to and ky 
cated in proximity to (or within) host computer 200, or 
computer software executing on the host computer Al- 30 
temativety, decoder/billing block 300 might be kscated re- 
motely to host computer 200 and communk:ate with the 
host computer via a data communicatk^ns network or a 
telephone line. 

Storage medium 100 is preferably some form of in* 3S 
expensive nriass digital information store (e.g., an optical 
disk, a bubble memory or a large hard disk or other fast 
transfer rate magnetic storage technoksgy) prepared by 
the database owner and Icensed to the user for use. 
CD-ROM, GDI, WORM, and other related optcal/digital 4C 
very large capacity storage modalities are now coming 
to the personal computer market and can be used for 
this purpose. These products are highly reliable, and 
very economcally store hundred of megabytes up to 
multiple gigabytes of data. 4S 

For example, a CD-ROM disk stores 550 megabytes 
of informatkxi on a single 12 centimeter laser diskette. 
CO-ROM technok)9y now being released to the market 
will economically support up to eight parallel drives (4 
gigabytes or 1,800.000 printed pages) and will access so 
any desired sector in one second. In the next several 
years, technological advances should reduce access 
time to 1/4 second, and storage capacity will be doubled 
(450,000 pages per diskette and 3,600.000 pages 
on-line) if CD-ROM manufacturers decide to market dou- ss 
ble-stied disks and drives. CD-f^M, CDI, and WORM 
products will be increasingly affordable over the next 30 
months, with CD-ROM prices estinrwted to drop from 



$800.00 to $400.00 or less per drive, including controller 
and OEM and volume prices estimated to drop to as tow 
as $1 75.00 per unit by 1 990 With CD-ROM, WORM, and 
other optical/digital technologies, users can both pur- 
chase large scale information bases and also them- 
selves easily build organization -specific information bas- 
es. 

The database is preferably 'preprocessed' and then 
stored onto medium 100. The type of preprocessing per- 
formed depends upon the database and the application, 
but typically includes creating an encrypted rendition of 
the database and loading the encrypted rendition onto 
medium 100. One or more oMhe many sophisticated 
conventional data encryption schemes which presently 
exist can be used for encrypting the database. Preproc- 
essing preferably also includes generating an index to 
the database and storing the index together with the en- 
crypted version of the database on the storage medium 
1 00. The index may or may not be encrypted. 

The preprocessed database may be k>aded onto 
storage medium 100 in a conventranal fashion. For ex- 
ample, a "master" medium may be prepared, and then 
simply duplicated to yiekj a number of duplicate storage 
media 100. Storage of the entire preprocessed database 
(or databases) may require several storage medium 
units (i.e., several optk;al disks), each unit storing a part 
of the database. The database can index one or more 
databases each containing one or more files, documents 
or "properties" (the term "properties" referring to a literary 
or other textual work protected by copyright). 

FIGURE 2 shows one exemplary scheme for storing 
database information on medium 100. The information 
stored on medium 1 00 includes an index portwn 1 02 and 
an encrypted database portkxi 104. Database portion 
104 includes a plurality of predefined quantities, or 
•blocks". 106 of digital data. Each block 106 includes 
three inforntatkxi f iekJs": an index key field 108a; an en- 
crypted database informatkxi fteki I08b; and a decryp- 
tion key/error<hecking fiekJ 108c. 

Index portion 102. which may be encrypted, pro- 
vkjes information used to translate a database access 
request into the addresses of one or more blocks 106. 
The contents of index portion 102 depends on the type 
of database stored on medium 100 and the type of op- 
erations which are to be performed on the database. For 
example, if word or string searching is to be provtied, 
index portnn 102 may include a list of all of the words 
contained in the database and the bkxks 106 in which 
the listed words appear. Index portkDn 1 02 may alternate- 
ly (or also) include a "table of contents" of the database 
and a designatkxi of the blocks 106 covering each entry 
in the table. Index portion 1 02 may not even be expressly 
stored, but may bo created through conventional 
processing techniques each time the database is ac- 
cessed. Other ways, structures and techniques to index 
a database are known, and the present invention is not 
limited to any particular indexing scheme. The preferred 
embodiment uses expressly stored index information be- 
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cause of speed performance considerations, but alter- 
nate indexing arrangements might be desirable in spe- 
cific applications. 

Index Key 106a of each block 106 stores data which 
can be referenced in accordance with information stored 5 
in index information portion 102. Index key 108a may be 
exploit (e.g.. a digital data word representing an indexing 
code or address) or implicit (e.g., physical 'addresses' 
of storage medium 10O may themsetves be used as in- 
dexing keys). ^0 

Encrypted database information fieW I08b contains 
predetermined portions of the encrypted database (the 
information stored in these fields may be text, graphics, 
or both text and graphics). The size of these portions may 
be determined by the particular hardware and/or encryp- is 
tion techniques used, and is preferably (but need not be) 
fixed. If the nature of the database permits, kjgically-re- 
lated information should be stored in the same blocks 
106 (i.e., the database shoukl be presorted and hierar- 
chically organized) to reduce the number of accesses of 20 
storage medium 1 00 required to respond to a single user 
request Techniques for organizing databases are known 
to those skilled in the art of information retrieval and da- 
tabase design and nnanagement 

Decryption key/error-checking fieW 108c performs zs 
two functions in the preferred embodiment. First, it pro- 
vides conventkyial error checking (e.g. CRC or parity) 
information useful for detecting informatkxi reading er- 
rors. Secondly, the fiekl may provide informatkxi needed 
by sophistk:ated data decryption schemes to decrypt the ^ 
information stored in associated field 1 08b. In many data 
decryption schemes, a decryption key word (which may 
itself be encrypted) carried with the encrypted data is 
used in conjunctkxi with an addrt»nal data decryptk^n 
key generated supplied by the data decrypting device to ^ 
decrypt the data. Field 108c may or may not be required 
depending upon the error checking and decryptkxi 
schemes emptoyed. 

Host computer 200 contains resident software and 
hardware whch provties an interlace for all database ^ 
transactons. Computer 200 includes one or more appro- 
priate I/O handlers and associated hardware device driv- 
ers which permit the computer to read information from 
storage medium 100. Most computer 200 also includes 
appropriate data communicatkxis software and associ- ^ 
ated hardware which permits it to exchange data with 
decoder/biller bkxk 300. The data communk:atk>ns 
pathway between host computer 200 and decoder/biller 
block 300 may be a shared data bus. a dedicated I/O 
channel, a shared data communicatkyis network, or the so 
tike. 

If desired, digital signals may be stored on medium 
100 in compressed fonm (e.g.. where redundant bit pat- 
terns are not stored so as to reduce storage space re- 
quired), and decoder/bttler bkxk 300 may include a de- ss 
compresskxi component (e.g., a conventional hardware 
data decompression chip or a processor capable of per- 
forming a conventonal data decompression algorithm 



under software control) to conventionally "decompress' 
the data read from the medium (either before or after de- 
coding and decryptkjn). Because medium 100 typically 
has a limited storage capacity and the size of a database 
can be arbitranty large, data compression is preferably 
used to increase the amount of information that can be 
stored on medium 100. Transparent decompression ts 
particularly useful when the objective is to store a maxi- 
mum amount of information or data resources, particu- 
larly on optical or related media with finite capacity De- 
compression is perfomied by a dedicated high-speed 
hardware data decompression integrated circuit in the 
preferred embodiment in order to maximize decompres- 
sion speed and minimize or effectively eliminate per- 
ceived delay time, although software decompression al- 
gorithms may be desirable in certain implementations. 

When a user requests information from the data- 
base stored on storage medium 100, the computer pro- 
gram resident on computer 200 controls hardware of the 
computer to read the index information 102 stored on 
medium 1 00 in order to ascertain which database blocks 
106 contain informatwn specified by the user request. 
The computer program then controls host computer 200 
to toad one or more blocks 106 of the stored database 
informatron into the host computer memory. The host 
computer 200 then, under software control, strips off the 
contents of encrypted fieWs 108b from the blocks of in- 
formation now resident in its memory (akxig with some 
or all of the contents of decryption key/CRC fiekt I08c) 
and sends some or all of this informatkxi to the decod- 
er/biller block 300 for processing. 

Because the index portion 1 02 is not encrypted, host 
computer 200 can manipulate the index information with- 
out involving decoder/biller block 300. Although this is 
an important advantage in some applications (since the 
user is permitted to 'browse' through the index "for 
free*), other applicatkxis may demand a level of security 
whk;h is compromised by providing an unencrypted in- 
dex. For example, unencrypted, very complete indexes 
might be used to reconstruct significant portions of the 
database itself. It may therefore be desirable to encrypt 
index portk^n 1 02 as well as database portkxi 1 04 to pro- 
vkje higher security. 

If index portkxi 102 is encrypted, it must be decrypt- 
ed before a user can make selections from it or othenwise 
use it to locate blocks 1 06. Decryptkxi of index portion 
102 should be performed in a secure environment (such 
as in decoder/biller block 300, or in a dedicated 'brows- 
ing workstation' to be discussed in connectkin with FIG- 
URE 5). Alternatively, decoder/biller bkx;k 300 may tem- 
porarily provide host computer 200 with the decryptkxi 
key information needed to decrypt index portion 1 02 (the 
index portkxi may be encrypted using an encryption 
technk^ue whk:h is different from the one used to encrypt 
database portkxi 104), and the host computer can de- 
crypt sectkxis of the index portkxi as needed by the user. 

In one possible permutation of the invention, neither 
the database nor the index stored on medium 1 00 is 'en- 
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crypted" using a formal encryption algorithm, but in- 
stead, the manner in which the database and/or the in- 
dex is stored on the storage nnedium is itself used to 
make information incoherent unless it is read from the 
medium using a predefined access algorithm. 

For example, records of the database may be 
non-contiguously stored on medium in a pseudo-random 
order, so that sequential reading of records produces 
only incoherent information. An index stored on medium 
100 contains the Infomnation needed to locate logically 
sequential database records. This index ("directory 
map*) may also be in some way 'scrambled" (for exam- 
ple, encrypted using formal encryption techniques, per- 
haps simply incomplete so that it must be supplemented 
with information and/or algorithms contained in decod- 
er/biller block 300, or another scheme can be used to 
properly interpret the directory map, directory map inter- 
pretation being necessary to determine the locations on 
medium 100 of the components of a given database or 
other "property"). Different index scrambling schemes 
can be used for different copies of storage media 100 to 
prevent development of a 'universal' de-scrambling de- 
vice or algorithm. 

Decoder/biller bkxk 300 measures the amount 
and/or type of informatkxi sent to it for decryption and 
stores tnfontiation indicating database usage over time 
from such measured amounts. Decoder/biller bkxk 300 
stores all necessary billing and usage infonmation in a 
protected, non-volatile memory device (or in a protected, 
non -volatile storage facility within the host computer 200) 
for later retneval and use in calculating database usage 
fees. 

Because the database information read from medi- 
um 1 00 is useless unless it is first decrypted, and decod- 
er/biller block 300 is the only portion of system 10 which 
is capable of decrypting the encrypted database infor- 
mation, the decoder/biller bkxk can accurately meter the 
amount and nature of data accessed from the stored da- 
tabase {e.g. , by counting the number of blocks 106 whch 
are decrypted, determining the group of k3gx:ally related 
informatkyi (e.g. 'properties') stored on medium 100 
which is logically associated with the data being decrypt- 
ed, and/or determining other convenient parameters in- 
dicating the quantity and/or kientity ot data which is de- 
crypted). Oecoder/bitler block 300 decrypts the informa- 
tion sent to rt, and retums the decrypted informatkxi to 
host computer 200 for display, storage, printing, telecom- 
munications, or the like (or otherwise makes the decrypt- 
ed information available to the user). 

FIGURE 3 is a more detailed schematic diagram of 
the decoder/biller bfcxk 300 shown in FIGURE 1. Block 
300 includes the folbwing: a tamper-proof mechanism 
302: a data connector 304 for connectkyi to the host 
computer 200; a data connector 306 for connectkxi to 
an off -site sen/k:e company; host computer interface log- 
ic 308; database decryptksn logic 310; interface ksgtc 
312; a ncn-volatile menrxsry 314; decoder control \oqic 
31 6; and a real-time ckxk/calendar 318. 



Tamper-proof mechanism 302 prevents unauthor- 
ized persons from electronically or mechantcatly tamper- 
ing with decoder/biller block 300, and preferably includes 
both mechanical and electronic safeguards. For exam- 
5 pie. the physical enclosure which encapsulates the com- 
ponents of block 300 should prevent unauthorized indi- 
viduals from accessing the enclosed components. The 
components can be epoxied or potted if desired, and/or 
the enctosure can be provided with a mechanical seal 

10 which clearly evidences any tampering. 

Another safeguard against tampering can be provid- 
ed by implementing one of more of functional blocks 
308-318 in the form of a custom integrated circuit. Such 
custom integrated circuits are not easily reproducible by 

'5 an unauthorized person, nor could functional equivalents 
be designed ("black-boxed*) so long as the techniques 
used to encrypt and decrypt the database are sophisti- 
cated. This level of data encryption sophistrcation is well 
within present technokjgy. 

20 Connector 304 and interface logic 308 communicate 
data between decoder/biller block 300 and host compu- 
ter 200. Interface logic 306 includes conventional elec- 
tronics which interface host computer 200 with decoder 
control k)gk: 31 6. Interface k^k: 308 is electronically con- 

2S nected to physk:al electronk; connector 304, whk:h in 
tum is connected to a mating connector of host computer 
200. 

The exact configuratkxi of interlace logic 308 and 
connector 304 depends upon the nature of host compu- 

30 ter 200 and type of data communications pathway de- 
sired. For example, in one exemplary arrangement, con- 
nector 304 comprises a host computer bus connector 
(connected to the main bus of host computer 200 and 
addressed directly by the host computer processor) and 

^ interface logic 308 comprises a bus interface. Of course, 
connector 304 couW comprise a standard RS-232 port 
connector and interface logic 308 coukj comprise con- 
ventional port interface togk: - or the interface logic could 
comprise a communk:ations controller (e.g., a data com- 

40 munkiations network controller or a modem) and the con- 
nector 304 could be a standard communications connec- 
tor (if decoder/biller bkxk 300 were located remotely 
from host computer 200). 

Other communk:ations connectors and/or ports 

4S might be used for connector 304, the specific arrange- 
ment used being chosen based on the application, con- 
venient performance and/or cost. Other possible ar- 
rangements, including placing the decoder/biller block 
300 into the same housing containing the drive which ac- 

so cesses medium 100, or connected to (or actually con- 
nected as part of) cabling connecting the drive for medi- 
um 100 to host computer 200, can be used. 

Decoder control \oq\c 31 6 preferably includes a con- 
ventional microprocessor pre-programmed with a prede- 

55 termined control computer program, but might be imple- 
mented in other ways (e.g.. as a discrete digital logic se- 
quential state machine). Decoder control logic 316 con- 
trols all of the functions of decoder/biller block 300 in the 
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preferred embodiment. Decoder control logic 316 also 
monitors database usage, produces digital data indicat- 
ing the amount of such usage, and stores this data in 
non-volatile memory 314 for later retrieval (e.g., by a 
sen/ice company or the database owner). 

Real time clock/calendar 318 permits database us- 
age metering to indicate the time and date of each usage 
and the duration of usage, thus providing an important 
audit tool for both customers and the service company. 
In addition, this real-time clock/calendar 318 can be 
pre-programmed to allow the user to access certain da- 
tabases only at pre-programmed times (e.g., by limiting 
access for given user security access codes). 

Interface logic 312 and connector 306 may be used 
to communicate data with an off-site facility, such as the 
centralized computer of the database owner or a sen/ice 
company which handles periodic database usage billing. 
In one exemplary embodiment, connector 306 includes 
a standard telephone connector and interface logic 312 
includes a standard modem, if desired, connectors 304 
and 306 may comprise the same connector, and inter- 
face logic 308 and interface logic 312 rriay comprise the 
same components. 

Database decryption logic 310 takes input digital 
data signals provided to it by decoder control logic 316 
(these signals representing encrypted digital data read 
by host computer 200 from storage medium 100 and 
passed to the decoder control k>gk; via connector 304 
and interface togc 308), decrypts these digital data sig* 
nals using a predefined decryptk)n algorithm, and out- 
puts decrypted data signals to the decoder control \ogic 
for display, printing, and the (ike. One or several different 
predefined decryption algorithms can be stored in (or 
hardwired within) decryption logic 310, and additional 
decryption algorithms can be downloaded into the de- 
coder/biller block 300 as needed or required via interface 
logic 312. 

Many conventional methods of encrypting/decrypt- 
ing data are known, spanning from simple kX3kup tables 
to complex mathsfnatical algorithnris. The method of data 
encryption/decryption used depends on the amount of 
extra computer processing overhead and data storage 
space that the application will alksw. It is not uncommon 
for substantial overhead to be needed to handle encrypt- 
ed data 

To install system 10. storage medium 100 (akxig 
with its associated drive/access device) is connected to 
host computer 200. and decoder/biller 300 is also con- 
nected to the host computer port and/or bus (by connect- 
ing connector 304 as described). A non-volatile memory 
314 is provkjed which has been preloaded with the 
foltowing , infomiatxxi (or is loaded upon tnstallatkxi): 

(a) database key(s) and/or user password(s); 

(b) billing rates (optkxial - may be performed by the 
database owner at his own facility); 



(c) expiration date and 'antidote" information; and 

(d) user identification(s)/security levels (if desired) 

5 FIGURES 4(A)-4(B) are together a high-level flow- 
chart of the routine 400 performed by system 10 to ac- 
cess a portion of the stored database. 

To access database informatksn, the user causes 
host computer 200 to execute software resident within it 
10 whrch permits the user to formulate a database access 
request (bkxk 402). As discussed above, the nature of 
the access request depends on the nature of the data- 
base and the needs of the user Most users require the 
ability to perform lexical database searches (i.e., search- 
IS es for words, strings, and the like). However, other meth- 
ods of accessing information are also possible. For ex- 
ample, if the database is a literary novel, the user's ac- 
cess request might be a chapter number and/or page 
number. Personal Library Software, Inc. of Bethesda, 
Maryland, offers advanced indexing software technology 
which allows a user to perform both keyword and topcal 
searches (contrasting with other commercial products, 
which are limited to keyword searching technk^ues). Per- 
sonal Library software can be used to great advantage 
with the present invention. 

The user then inputs an access request (block 404) 
using a keyboard or other standard I/O device connected 
to host computer 200. In response to the user's access 
request, host computer 200 accesses index portion 102 
stored on medium 100 and obtains from the index porton 
the addresses of (or index keys corresponding to) each 
bkxk 106 of the encrypted database whk:h satisfies the 
user's access request (bkxk 406) (index portion decryp- 
tion is performed at this time if necessary). Host compu- 
ter 200 then reads the appropriate bkxk(s) 106 of the 
encrypted database from storage medium 100 and 
stores these bkxks of informatk)n into its own internal 
random access memory (bkxk 408). 

System 10 may require the user to input identifica- 
tion and/or password informatksn atong with his access 
request (bkxk 404). System 10 checks the authority of 
the user to access the database by transmitting the in- 
putted lO/password information to decoder/biiler block 
300 for comparison with a list of authorized IDs/pass- 
words stored in memory 31 4 (block 41 0). If decoder/biller 
bkxk decoder control logic 316 denies authorizatksn to 
continue with database access (because the inputted 
user information is incorrect, because the access re- 
quest cannot be performed at the current time/date, etc.) 
(bkxk 412). the decoder/biller bkxk refuses to decrypt 
any data sent to it (block 41 4) - and may cease commu- 
nk:ating with the host computer 200, and/or simply ignore 
any encrypted informatkxi the host computer sends it. 
While encrypted database informatkxt is already present 
in the memory of host computer 200, this encrypted in- 
formatkxi is incoherent and cannot be used for any use- 
ful purpose. 

On the other hand, if decoder control logic 316 of 
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decocter/biller 300 grants authority to proceed (block 
412). the decoder control logic begins a "billing cycle', 
and stores tnfornnation logging the billing cycle into 
non-volatile mennory 314 (block 416). The information 
stored in memory 314 may include; (a) the name of the 
database file being accessed; (b) the section of the da- 
tabase being accessed (name, 'property designation*, 
file name, or other identification information); (c) the 
identification of the user accessing the database; and 
(d) the date and time the database access begins. 

The information stored in non-volatile memory 314 
may thus be used to create an "audit trail" which tracks 
(and budgets, if desired) database use by different users 
(or groups of users). Special use passwords may be re- 
quired to access selected databases, and actual use of 
ail databases may be verified later from the information 
stored in memory 314. Such stored information is ex- 
tremely valuable not only to help detect unmonitored da- 
tabase use, but also to allow detailed bills to be gener- 
ated and to help determine which users among multiple 
users are responsible for generating usage charges. 
Such a detailed audit trail can be used to altow publishers 
and users to determine the detailed activities of users. 
This information can be used by users to determine what 
they are being charged for The audit trail infomnatkx) can 
also be used by publishers and property owners to con- 
duct marketing surveys - provkjing more detailed infor- 
matk^n about user demographics and informatnn use 
than is presently available. 

In addition, it may be desirable to code storage me- 
dium 100 (or partrcular databases or files stored on the 
medium) with unique (e.g.. randomly-generated) user 
passwords by embedding secret password infonnation 
in the database information. Non-volatile menDory 314 
can store information which matches the code associat- 
ed with the partrcular copy of the storage medium li- 
censed to a partkrular user This coded information can 
be encrypted, and coding schemes and/or coded infor- 
matksn may be changed perkDdk:atly. Different users can 
be assigned different codes to prevent users from ex- 
changing or sharing storage media 100. Such different 
codes corresponding to different users can also be used 
to track (and budget, if desired) database usage by indi- 
vidual users in order to help with budgeting and cost al- 
locatkxt - or even to permit specify users from selec- 
tively being denied access to all or some of the stored 
database. 

This additk)nal security feature also impedes the use 
of unauthorized decoder units (e.g., clandestine units 
manufactured to be 8imilartobkx:k300). Such unauthor- 
ized units woukj not be equipped with the correct coded 
informatbn, and even if they were, would work for onty 
one similarly coded storage medium (or for onty onre dr 
a few databases stored on a particular storage medium). 
The coding of storage medium 1 00 with embedded, us- 
er-identifying codes would also help to identify how any 
unauthorized copies of the database information came 
into being, since the coded informatkxi woukj be embed- 



ded in the database information itself and would thus 
also be present in any copies made from an original Us- 
ers found in this manner to be involved in copyright in- 
fringement could bo penalized appropriately under the 
5 civil and criminal penalties of the copynght taw. as well 
as for breach of their contractual obligations. 

Decoder control logic 31 6 also is enabled at this time 
to begin (a) decrypting information sent to it by host com- 
puter 200 and (b) sending the decrypted information 
10 back to the host computer (block 418). Decoder control 
logk: 31 6 meters the quantity and/or other usage param- 
eters of data which is decrypted, and stores this usage 
information into non-volatile memory 314 along with the 
other billing information (block 420) (the decoder control 
IS logic may store quantity information directly into the 
memory, or may first convert it to billing information tak- 
ing into account, for example, the cost of using the da- 
tabase file being accessed). This process continues until 
the user's request has been satisfied (as tested tor by 
bkxk 422). 

The user can be billed an annual fee for unlimited 
use of some databases or datat>ase properties, and 
billed onty for actual use of other databases or database 
properties. In this way, the user can pay a flat fee for the 
databases, or specific database properties or "txDoks*, 
he uses most often, and yet have access on a 
"pay-as-you-go" basis to other databases which he 
might use occasionally but not enough to justify paying 
the cost for unlimited use. This billing method provides 
the user with database resources he might not othenA/ise 
be able to afford, and also stimulates use of databases 
which are not used often but are nevertheless extremely 
valuable at times. 

The specific steps performed to decrypt data (block 
416) depends on the particular data encryptkDn/decryp- 
tion scheme used. Host computer 200 transmits encrypt- 
ed data in predetermined quantities (e.g., fixed-length 
bkxks) to interface logic 308 via connector 304 in the 
preferred embodiment. Interface logic 308 communi- 
cates this encrypted data to decoder control logic 316, 
whk;h communk;ates it to data encryption/decryption 
logic 310. Logic 310 translates the encrypted data into 
intelligible informatran using a predetermined conven- 
tional decryption algorithm, and communicates the de- 
crypted data back to decoder control \oqic 316. Decoder 
control logic 316 then communicates the decrypted data 
to host computer 200 via interface logic 308 and connec- 
tor 304. 

The database access program resident in the host 
computer then controls the host computer to display 
and/or print the decrypted information. If desired, the pro- 
gram reskJent in the host computer 200 can prevent the 
user from doing anything other than displaying (and/or 
printing) the decrypted data. Alternatively, this program 
may permit the user to manipulate the decrypted text 
(e.g., store the data in a disk file or in the memory of the 
host computer) to permit the user to browse through 
full-text data at his leisure and/or to use this data for word 
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processing, tetecommunicating, or the like 

Decoder control logic 316 meters database usage 
(block 420) by, for example, measuring the amount of 
information which is decrypted (e.g., by counting the 
number of fixed-length blocks which are decrypted; de- 5 
termining the source documents the decrypted informa- 
tion is associated with; and measuring the time, date 
and/or duration of access of the decrypted information). 
Control logic 316 may also record other billing informa- 
tion, such as the length of the database file being io 
opened. Control logic 316 may be arranged to recognize 
the names or other designations of subsections of the 
database being accessed, allowing for different billing 
rates depending on the type or supplier of the information 
(so that use of more expensive databases can be billed is 
at higher rates). 

1 1 may be desirable to not bill users for simply search- 
ing through the database (or at least, not bill at the full 
rate), but to bill only or at a higher rate for data that is 
decrypted and displayed, printed or communicated. It is so 
for this reason that the database index is not itself en- 
crypted In one embodiment -- so that the user can 
browse through the index Vorfree' (orata tower charge). 
As mentioned previously, however, it may be desirable 
in some instances to provide additional security by en- 2S 
crypting the index as well as the database. If decoder/bill- 
er block 300 decrypts the index, it can meter index usage 
and store this usage information into non-volatile mem- 
ory 314 thus permitting the user to be billed for index 
browsing at comparatively low rates. A dedicated 30 
'browsing terminal' (to be discussed shortly) may be 
used in some applications to provide a secure environ- 
ment in which browsing can occur and billed at a rate 
which may differ from that for database informaton us- 
age (e.g., printing, telecommunicating, copying, etc). 3S 

After the user's access request has been satisfied 
(as tested for by block 422), the decoder control logic 
stores, into non-volatile memory 314, the time the user 
finishes accessing the database. (bkx;k 424). The resi- 
dent program then allows the user to input another ac- 
cess request (using the same or different database) 
(block 426). If the user does input another access re- 
quest, the steps of blocks 404-426 are performed again 
(with blocks 41 6, 420 and 424 causing an additional bill- 
ing log entry to bo stored in memory 31 4), ^ 

The informatkxi stored in memory 31 4 is periodically 
communicated to the service company and used to bill 
the user for database usage. In one exemplary emtxxj- 
iment, memory 31 4 is housed in a storage module 31 4a 
which is easily separable from system 10. PerK>dk:ally, so 
the user disconnects memory module 31 4 from decod- 
er/biller block 300. mails the module to the service com- 
pany, and installs an alternative replacement module 
(the 'next' n^ule) into system 10. Decoder control logic 
316 disables data decryption unless a module 314a is ss 
connected to it (and perhaps also when the control ksgic 
has determined the non-volatile storage area is nearly 
full). 



As mentioned previously, memory module 3i4in the 
preferred embodiment is a non-volatile memory modute 
which IS electrically connectable to system 10. In some 
applications, however, it may be desirable to use a con- 
ventional magnetic "stripe" card and associated reader 
(or equivalent technology) for memory module 314 (or to 
supplement the memory module). For example, a mag- 
netic stnpe card magnetically pre-coded with credit and 
other information (e.g.. a dollar amount and a user iden- 
tification) can be issued to the user by the database pro- 
vider. System 10 might require the user to insert a mag- 
netic stripe card in the reader as a prerequisite for ac- 
cessing the databases stored on medium 100 The user 
can be "charged" for accessing databases by decre- 
menting the dollar amount stored on his personal mag- 
netic stripe card •- and be prevented from further access 
when the dollar amount has been decremented to zero. 

Access to system 10 can be made dependent on in- 
sertion of a magnetic card storing a user identification 
which corresponds to a secret password keyed in at time 
of access making it more difficult for unauthorized us- 
ers to access the system 10. The magnetic card might 
also store indicia of specific databases the card owner 
may access, and system 10 can restrict the user to ac- 
cessing only those databases and/or properties corre- 
sponding to the informatksn stored on the user card, and 
may contain specific budgets defining the amount of us- 
age the user is entitled to for each gf those databases 
and/or properties. 

In another embodiment, communicatkins between 
decoder/billsr block 300 and the service company is pe- 
riodically established for the purpose of downloading the 
contents of memory 314 to the servrce company billing 
computer. If connector 306 arxi programming interface 
logic 312 comprise a conventional standard telephone 
connector and associated modem, such communica- 
tions can be established over standard telephone lines. 
The information stored in memory 314 is transmitted 
over the telephone line to the service company compu- 
ter, and the service company computer then transmits 
commands which control decoder control logic 316 to re- 
set the memory. In addition, the sen/ice company can 
establish communications with decoder^illef block 300 
to monitor use of the databases stored on medium 1 00 
(and detect misuse and unauthorized use). The service 
company may also control decoder/biller block 300 re- 
motely (e.g., to disable it from operating if customer fails 
to pay his bill, or to remotely alter budgeting parameters, 
passwords, encryptk^n keys, and other parameters 
stored in memory 314). 

System 1 0 may include an enabling/disabling mech- 
anism which prevents a user from accessing the stored 
database informatkxi rf he fails to pay his bill. For exam- 
ple, in the embodiment discussed above having a sepa- 
rable memory module 314a, the sen/k;e company can 
refuse to mail the user a replacement module until alt 
outstanding balances are pakj. If the customer fails to 
pay his bill, ho will eventually fill up the merrrory module 
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he has installed, causing decoder control logic 31 6 to dis- 
able data decryption (or atternativety, the modules 314a 
can be electronically data-coded, and the decoder con- 
trol logic can refuse to permit decryption to be perlormed 
when the nnodute date code is determined to be prior to 
the current date generated by real time clock/calendar 
318). 

Decoder control logic 316 can be disabled from op- 
erating if the real time clock ever ceases to operate (for 
example, the clock may be battery powered and the bat- 
tery might go dead after a year or so if scheduled pre- 
ventive maintenance is not performed). Once the real 
time clock is repaired, a communications link can be es- 
tablished between decoder/biller block 300 and the cen- 
tral facility. The central facility can then read the contents 
of non-volatile memory 31 4. If no suspicious or unauthor- 
ized activities have occurred, the central facility can reset 
real time clock 318 or check a kxally set real time clock 
to permit nornrial database decoding operations to 
resume. 

Another arrangement can control, decoder control 
logic 316 to periodically, automatkially change author- 
ized passwords ~ and the service company can refuse 
to tell the customer the new passwords until the custom* 
er has pakj his bill. 

Altematively or in additkxi to the arangements dis- 
cussed above, system 10 may be provided witfran au- 
tomata "self-destruct" mechanism which autonnatically 
'destroys" a critical part of the system (e.g., the informa- 
tion stored on medium 1 00, or the password table stored 
in non-volatile memory 314) at a preset real time dead- 
line (timed by real time clock/calendar 318) unless the 
customer implements an "antktote' (e.g., inputs a series 
of secret code words) prror to the deadline. The 3ervk:e 
company can provide antidote instructions only to cus- 
tomers who have paid their bills. This autonnatk: 'self-de- 
struct* mechanism can also be activated whenever the 
customer exceeds a predetermined maximum (and/or 
minimum) usage limit (so as to prevent a customer from 
running up a huge bill, from attempting to decrypt and 
store substantial portkxis of the unencrypted database, 
or from continuing to use the database in the unlikely 
event that he has successfully prevented the k^gging of 
usage informatioo). If additkxial protection against data- 
base piracy is desired, the automatic "setf-destatcf 
mechanism can also be activated whenever the user at- 
tempts to access, in one session or over a number of 
different sesskxis or within a given time frame, more than 
a certain percentage of a given database and/or more 
than a certain number of contiguous blocks of (or k^i- 
calty related records or other subdiviskxis of) the same 
database. A permanent record of the bkx:ks (records or 
other subdivtskxis) whk:h have been accessed may be 
retained in non-volatile memory 314 so that the user can 
be prevented from copying an excessive amount or se- 
lected database properties or segments over a perkxJ 
determined by the database owner. 

It may also be desirable to enable the user to pro- 



gram parameters stored in non*volatile memory 314 
which limits the user's own use of database information 
stored on medium 100. The routine shown in FIGURES 
4(A)-4(B) can provide a user interface with decoder/biller 

5 block 300 which permits a user to optionally store, m a 
user-accessible file within memory 314, information rep- 
resenting ceilings on database usage or cost of usage 
over a period of time (e.g., a maximum monthly duration 
or cost for database usage, limitations on the type of in- 

10 formatkDn whk:h can be decrypted, etc.) Decoder/biller 
block 300 keeps a running total of the parameter(s) the 
user has specified, and ceases decrypting database in- 
formation if the total exceeds the user-specified param- 
eter value. This feature permits the user to budget his 

IS database use. and is especially valuable in a business 
environment -- since it permits an organization to directly 
limit the cost of database access by employees to an 
amount selected by the organization. 

Although the embodiment shown in FIGURE 1 is 

20 particularly suited for instattatnn at a customer site, 
some applications might necessitate that decoder/biller 
bkxk 300 and storage medium 100 be operated remote- 
ly to the customer site and communicate informatksn to 
the customer via a communications link (e.g., a standard 

2S telephone line). In this "direct connect decryptk^n' mode 
of operatkxi. data decryption is pertormed at a central 
facility of the service company. Since only a small portion 
of the database is decrypted at any one time, a telephone 
line provkles sufficient bandwkith to transmit the decrypt- 

30 ad data at rates suitable for display by the customer's 
computer 

Using the "direct connect" mode, there is no need 
for periodic exchange of service storage modules or for 
p re-scheduled perkxlk; communtcatksns with the local 
35 host computer Billing data could be accrued in real time, 
and the sen/ice company couW disconnect or change the 
servk:e of a customer at any time. Database updating is 
also simplified, and current information or changing data 
is always at hand (since it can be autorr^tically included 
40 in a user database search). Moreover, the user can use 
just about any kind of computer to access the service 
company central facility. Furthermore, the connect time 
charges for communicatran networks are becoming 
more competitive in price, making this "direct connect" 
4S mode attractive for some applk:ations. 

The chief disadvantages of this "direct connect" ap- 
proach are: Database access speed is much slower than 
in the locally-installed embodiment discussed above (be- 
cause of the shared nature of the central facility and be- 
so cause of the relatively low data transmission rate of 
standard telephone lines); communicatwns costs are 
much greater; and the servce company must purchase 
and operate an expensive multi-user computer facility. 
The "direct connect" and the locally stored database 
s$ features might be used together in some applications. 
For example, the bulk of a database can be stored on 
and accessed locally from a kxal storage medium 100. 
Database update file information can be stored and up- 
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dated at a remote centralized facility and accessed via 
a telecommunications link to provide extremely current 
information in addition to the 'older' information provided 
on-site. 

There are thus both advantages and disadvantages 
to the "direct connect" mode. This mode may be offered 
as an option for users who require up-to-the-minute up- 
dated databases. 

Once data is decrypted and stored into the memory 
of host computer 200 (e.g., for searching or manipulation 
rather than simply for display), it is susceptible to being 
intercepted by a 'pirate" intercept program. System 10 
bills for the data which is decrypted (so that the user 
would run up a huge bill if he tried to copy a large portion 
of a database). Nevertheless, it may be desirable in 
some applications to restrict the manner in which a cus- 
tomer can use decrypted data, white at the same time 
not restricting maniputations (e.g.. browsing) of the de- 
crypted data 

* For example, keyword searching does not require a 
data image of the database (rather, it is most effkiientty 
performed using index information 102). However, other 
search techniques (e.g., final 'zooming in' of the infor- 
mation being searched for) may require manipulation ot 
a data image. It may be desirable to absolutely prevent 
the user from copying the decrypted data image infor- 
mation. However, the user shoukj be able to manipulate 
data images in other ways (e.g., by browsing through 
full-text data and the like), tt may be impossible to impose 
such restrictions on data stored in the user's own host 
computer 200 (or the user may be able to easily defeat 
such restrictions once imposed through skillful program- 
ming techniques). 

FIGURE 5 is a block diagram of an alternate embod- 
iment of a database usage metering and prclectkxi sys- 
tem 500 in accordance with the present invention. The 
FIGURE 5 embodiment includes a dedk:ated independ- 
ent hardware unit ("browsing workstation") 501, which 
can either act as a 'stand-alone' or be designed to inter- 
face with additk^rial data processing components. 

Browsing workstatkxi 501 in the preferred embodi- 
ment includes a proprietary, single-board computer 502 
connected to a dedicated proprietary display statkxi 504 
having a secure environment. Computer 502 includes a 
bus connector 506, a host interface 508, a CPU 510, a 
volatile, protected merrxjry 512, a non-volatile memory 
513, and a display driver 514. Computer 502 is enck>sed 
in a tamper-proof encbsure 516 to completely prevent 
access to its internal components except by authorized 
service personnel. 

Computer 502 perfpmis the decryptwn and billing 
functions discussed previously, and then stores the de- 
crypted data into its own memory 51 2. This arrangement 
allows the user to review ("browse") the information (on 
dedicated display statk)n 504) prksr to sending desired 
informatk)n to his host computer (via interface 508 and 
connector 506) for printing or other use. Thus, the de- 
crypted database data image is first stored and manipu- 



lated by computer 502. The user can be billed at one rate 
for browsing through or otherwise manipulating data in 
computer 502. and billed at a higher rate for transferring 
data to his host computer (from which the data can be 

s printed, stored, outputted, or telecommunicated to other 
computers and users). 

The user can evaluate the data while it is resident in 
computer memory 512 (via display station 504) in order 
to decide whether or not he really wants the information 

10 transferred to his own host computer In this way. very 
different billing rates can be provided for (a) browsing 
large amounts of full-text information and (b) actual use 
of information in the host computer (e g., tor word 
processing, telecommunications, printing, etc.). 

IS Browsing workstatkyi 501 may share some of the 
hardware and/or software of a host computer in order to 
reduce hardware costs - so long as information security 
is not signif icantty compromised. For example, one of the 
workstations normally connected to the host computer 

20 and its associated driver might be used in lieu of dedi- 
cated display statkxi 504 and display driver 514 if there 
is little or no possibility that the user couki copy a signrt- 
icant part of a database by reading informatk>n produced 
by the host computer display driver while browsing is in 

2S progress. 

In a further embodiment, sophist k^ted software (not 
susceptible to manipulation or other misuse) coukj be 
temporarily k^ded into the host computer (e.g.. from 
storage medium 100) and executed to provide the func- 

30 tionality of some or all of the hardware "blocks' shown 
in FIGURES 3 or 5. Such software might use the security 
system provided by the host computer (and/or sophisti- 
cated technk^ues whk:h are difficult to discover and 
"break") to create a protected environment within the 

35 host computer itself for decryption of database informa- 
tion and non -volatile storage of database usage informa- 
tion which may be adequately secure for vark}us appli- 
catkxis. For example, a conventkxial minicomputer 
could be provkjed with a single hardware card capable 

40 of storing information such as encryption keys and user 
access codes (this card possibly also having some signal 
processing capability), and the card could be accessed 
by dedk:ated software to perform database decryption 
and access functions. 

^ To further increase system security, workstatksn 501 
can automatteally compare the amount of information 
read from storage medium 100 with the amount of infor- 
mation used by the host computer. Statistical analysis 
can be used to assess whether a reasonable relationship 

so exists between the arriount of informatnn "browsed" and 
the amount of informatk)n used by the host. 

Such statistical analysis can be based on, for exam- 
ple, the past history and habits of the specific user, sta- 
tistical mearr usage parameters calculated for a number 

55 of users, or both. If workstation 501 determines that the 
user is "browsing" much more information than "normal" 
refative to the amount of infonmatkx) he is actually using, 
the workstatk>n can take corrective action (e.g., sending 
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a message to the database provider over telecommuni- 
cations lines informing htm that possible abuse - or at 
least very inefficient searching techniques - may be oc- 
curring, or even preventing further database access until 
the user contacts the database provider). This type of s 
statisicat analysis is expecialty useful, for example, to 
add additional security to implementations in which the 
database access is performed via software executing 
under a general purpose computer operating system. 
Such database access software typically makes use of io 
operating system parameters which are poesibty subject 
to user manipulation, making the overall system more 
vulnerable. Statistical analysis and comparison of me- 
tered database usage and the amount of information 
read from storage medium 1 00 can detect discrepancies is 
in usage measuring parameters whk;h might have been 
caused by unauthorized user manipulation of those pa- 
rameters. 

Although it may be undesirable to permit data type 
decryption Key information to reside In the host computer 20 
permanently, the decryption key information can be tem- 
porarily provided by a protected memory device to the 
host computer. The host connputer may then decrypt da- 
tabase information using the decryption key information, 
and destroy the key information after use. The hoet com- 25 
puter may decrypt database information 'on the fty' and 
not retain much encrypted or decrypted infomnatxxi in 
memory at any one time to help prevent copying. 

A further precaution which can be taken to provide 
still additional security is to change the encryptkWde- 30 
cryption keys (artd/or the encryption/decryptkxi algo- 
rithm) periodically in response to an event (e.g., real 
time, number of contacts with the host or both) independ- 
ently ascertainable by both the host computer and the 
workstatbn 501 but not readily ascertainable by a third ^ 
party. These events may be known to the user (e.g., 
when a predetermined real time period expires or the real 
time counter reaches a prespecified time and date), or 
an event unknown to the user (e.g., a preprogrammed 
but secret relationship to a reaJ time clock output, or a ^ 
psuedo-random exchange of handshakes between the 
workstatkxi and the user whch are transparent to the 
user). Since the changing of the key(8) and/or algorithms 
used for encryption and decryption occurs pseudo-ran- 
domly (or randomly) from the standpoint of a third-party ^ 
user, unauthorized decryptkxi of the host computer da- 
tabase information becomes much more difficult. Using 
this encryption key anchor algorithm changing feature, 
by the time an unauthorized user is able to discover a 
partksular key or algorithm, that key or algorithm will no so 
longer be in use and an entirely different key and/or a 
modified or entirely different algorithm will be required in 
order to successfully decrypt database information. Ad- 
ditionally, an indivkiual who manages to break an en^ 
cryption code and/or key may not find a market for the ss 
result of his efforts, since other systems may be employ- 
ing entirely different encryption keys and/or algorithms. 

Although a dedk:ated hardware/software system 



typically provides the best assurance against tampering, 
techniques which may be -implemented in software ex- 
ecuting on a non -dedicated system may provide suffi- 
cient tamper resistance for some applk;ations. For ex- 
ample, secure program control and usage information 
can be stored on a floppy disk which is accessed via the 
disk drive of a general-purpose non-dedicated personal 
computer A non -volatile memory and logic device con- 
nected to the personal computer may (in conjunction with 
the secure program control software executing on the 
computer and/or a hardware controller connected to the 
computer) control and monitor the position of the 
read/write head of the disk drive, store the current head 
positran in the non-votatile memory, and supervise exe- 
cution of the secure program control software Database 
usage information may be gathered by the program con- 
trol software and stored on the floppy disk. Any attempts 
to tamper with the floppy disk which alters the last 
readAwrite head positkxi may cause a warning message 
to be stored on the floppy disk in a datat^se audit trail 
sectkan of the disk (possibly aksng with cumulative mes- 
sages indicating previous such occurrences) and may 
also result in destruction and/or disablement of the se- 
cure program control software. 

While the present invention has been described with 
what is presently considered to be the nrx^st practk;al and 
preferred embodiments, it is to be understood that the 
appended claims are not to be limited to the disclosed 
embodiments, but on the contrary, are intended to cover 
modificatk)n8, variatkxis. and/or equivalent arrange- 
ments which retain any of the novel features and advan- 
tages of this invention. 



Clalnne 

1. A method for distributing a protected database for 
use by a user, saki method comprising the steps of: 

delivering a database to said user, said data- 
base being at least in part encrypted; 
selecting at least one portion of sakJ database; 
decrypting, through the use of a database pro- 
tectkxi an-angement (300), at least a part of said 
selected database portk>n(s); 
metering, through the use of sakj database pro- 
tectkxi arrangement (300), at least one param- 
eter related to usage and/or processing of at 
least a part of sakj database to produce meter- 
ing information; 

characterized In that 

(a) sakj delivering step delivers said database 
to saki user locatk)n for use at aaki location on 
a storage medium (100). at least a portion of 
sakj database being protected by said database 
protectk^n arrangement (300); and by the fol- 
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lowing steps: 

(b) securely storing at said user location, 
through the use oi said database protection 
arrangement (300) at least a portion of said s 
metering information in a non-votatile memory; 

(c) securely storing, at said user location and 
through the use of said database protection 
arrangement (300). budget infomiation related 'o 
to enabling said user to use and/or process, 
and/or preventing said user from using and/or 
processing, at least a portion of said database; 

(d) enabling said user to access at least a por- is 
tion of said stored usage budget information; 

(e) testing, at said user location and through the 
use of said database protection arrangement 
(300). at least a portion of said stored metered 20 
information to detemnine whether the usage 
and/or processing of at least a part of said data- 
base results in at least one budget limit indr- 
cated by said stored budget information being 
exceeded; 2S 

(f) selectively not enabling or selectively pre- 
venting, at said user location through the use of 
said database protection arrangement (300) the 
usage and/or processing of at least a part of said 30 
database in response to said testing step (e) 
determining that said usage and/or processing 
results in said at least one budget limit being 
exceeded. 

55 

A method according to claim 1, further character- 
ized tn that said at least one budget limit specifies 
a percentage of said database and said testing step 
(e) determines if the usage and/or processing of said 
at least a part of said database results in said spec- 4o 
ified usage and^or processing of at least one per- 
centage Hmrt being exceeded, and wherein said 
selectively enabling or preventing step (f) does not 
enable, or prevents, the use and/or processing of at 
least a portion at said database in response to said ^ 
testing step (e). 

A method according to claim 1 or 2. wherein said 
method includes supplying, within at least one inte- 
grated circuit, said database protection arrange- so 
ment (300) to said user, wherein said database pro- 
tection arrangement (300) includes a special pur- 
pose, programmable, tamper resistant, integrated 
circuitry arrangement, said integrated circuitry 
arrangement at least in part securing against unau- ss 
thorized use and/or processing of at least a portion 
of said database; and 
said method further including the steps of: 



(a) storing in a non-volatile memory arrange- 
ment within said integrated circuitry arrange- 
ment, at least one of a password information 
and a user identification information; 

(b) performing at least a portion of said metering 
within said integrated circuitry arrangement; 

(c) storing in said non-volatile memory arrange- 
ment within said integrated circuitry arrange- 
ment, at least a portion of said metering infor- 
mation; and 

(d) at least in part performing said decrypting 
step within said integrated circuitry arrange- 
ment. 

4. A method according to claim 3, wherein said method 
further includes storing of billing information within 
said integrated circuitry arrangement, at least a por- 
tion of said billing information being calculated 
based on at least one portion of said produced 
metering information and at least one predeter- 
mined billing rate. 

5. A method according to one of claim 3 and 4, wherein 
said integrated circuitry arrangement includes 
modem circuitry and said method further includes 
communicating information to a remote location, at 
least in part through the use of said modem circuitry. 

6. A method according to one of claims 1 to 5, wherein 
said selectively not enabling or selectively prevent- 
ing step (f) includes, m response to said testing step 
(e). allowing flat fee database usage for a first por- 
tion of said database, and allowing for a second por- 
tion of said database that is different from said first 
database proportion, usage and/or processing 
based billing, wherein the cost of said second por- 
tion usage is calculated at said user location using 
at least a portion of said metering information. 

7. A method according to one of claims 1 to 6. wherein 
said securely storing step (e) includes storing at 
least a portion of said metering information in a 
detachable memory module operativety connected 
to and detachable from said database protection 
arrangement (300); and said method further includ- 
ing the steps of: detaching said detachable memory 
module; and using data stored in said detached 
memory module for the purpose of determining a 
usage history for said user. 

8. A method according to one of claims 1 to 7, further 
characterized in that said user is a customer and 
said method further includes specifying, by said cus- 
tomer and at said customer location, at least a por- 
tion of said stored budget information, said customer 
specified budget information specifying at least one 
limit for use and/or processing of at least one portion 
of said database by at least one of said customer's 
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employees. 

9. A method according to one of claims 1 to 8, further 
characterized in that said database includes plural, 
discrete properties, and wherein a first owner owns 
at least one right in a first property and a second 
owner owns at least one right in a second property 
and wherein said user is an organization having 
employees, said method further including the steps 
of: 

enabling said organization to establish at least a por- 
tion of said limit information by specifying a limitation 
for use and/or processing of at least one portion of 
said plural discrete properties by at least one 
employee of said organization; 
enabling a publisher to specify at least a portion of 
said limit information; and 
wherein said selectively not enabling or setectivety 
preventing step (f) includes selectively not enabling 
or selectively preventing the usage and^or process- 
ing of at least a portion of a database based, at least 
in part, on said organization specifidd and/or said 
publisher specified limit information. 

10. A method according to one of clainns 1 through 9. 
wherein said method further includes processing at 
least a portion of said metering information to pro- 
duce marketing survey information. 

11 . A method according to one of claims 1 through 7 and 
claim 10, wherein said user is an organization which 
has employees, said method further including the 
step of enabling said organization to specify, at an 
organization's site, at least a portion of said budget 
information, said organization specified budget 
information establishing at least one budget for lim- 
iting the quantity of at least a subset of said data- 
base's contents that may be used and/or processed 
by at least one of said employees of said organiza* 
tion; 

said selectively not enabling or preventing step (f) 
selectively not enabling, or selectively preventing, 
the usage and/or processing of at least a portion of 
said database based at least in part on said organ- 
ization specified budget 

12. A method according to one of claims 1 through 11, 
wherein sakj user Is an organization and wherein 
said metering information at least in part results from 
metering on the basis of plural groups of users within 
said organization; said method further includes pro- 
viding said organization with at least a portion of said 
group related metering information. 

13. A method according to one of claims 1 through 12. 
further including the step of making a copy of at least 
one portk)n of sakj database, wherein sakj copying 
step includes provkiing in said copy at least one 



embedded copy origin identifying code 

14. A method according to one of claims 1 through 13. 
further including the step of enabling said user to 

s topically search said database to identify database 
portions that have a topical relationship to, at least 
in part, user specified search criteria. 

15. A method according to one of claims 1 through 14, 
10 wherein sakj budget information includes at least 

one limit on cumulative usage and/or processing of 
logically related portions of said database, and 
wherein sakj method further includes the step of: 

IS (a) determining whether the usage and/or 

processing of at least one database portion, in 
combination with usage and/or processing of 
database portions prevkiusly used and/or proc- 
essed by sakj user, will exceed a limit specified 

20 by sakj limit information on the use and/or 

processing of data base portions that have a 
certain logical relatkxiship; 
(b) said, selectively not enabling or selectively 
preventing step (f) selectively not enabling, or 

2S selectively preventing, the usage and/or 

processing of at least a portion of said at least 
one database portkxi in response to sakj testing 
step (e) revealing that a datat>ase usage and^or 
processing exceeds at least one limit on the 

30 usage and/or processing of database portions 

that have sakj certain logical relationship. 

16. A method according to one of claims 1 through 1 5, 
wherein sakj selectively not enabling or preventing 

3S step (f) selectively does not enable or selectively 
prevents the use anchor processing of more than a 
certain quantity of contiguous database information. 

17. A system for distributing to a user a protected, 
40 stored, digitally encoded database portion, said sys- 
tem including a storage medium (100) for storing at 
said user location at least one database for use by 
said user, said database being at least in part pro- 
tected against unauthorized use and/or processing; 
characterlied by 

a special-purpose, tamper-resistant, enck>sed data- 
base protectksn arrangement (300) located at a user 
locatkxi, sakj database protectkxi arrangement 
(300) being adapted for securing against unauthor- 
so ized usage and/or processing of sakj database(s), 
said securing including securely metering at least 
one parameter pertaining to at least one of process- 
ing and usage of at least a part of sakj database, 
said database protection arrangement (300) includ- 
es ing: 

(a) a non-volatile memory (314) for use in 
securely storing budget information establish - 
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ing at least one budget limit related to the user's 
usage and/or processing of at least one portion 
of said database(s), said non -volatile memory 
(31 4) being also adapted for; 

(i) securely storing information based on at 
least a portion of said database metering, 

(ii) storing billing rate information, and 

(iii) storing information based on calculating 
at least a portion of the cost for said user's 
usage and/or processing at least a portion 
of said database(s); and 

(b) decoder control logic arrangement (316), 
adapted for: 

(i) said secure metering of said at least one 
parameter pertaining to at least one of 
processing and usage of at least a part of 
said database; 

(ii) securely testing said stored metering 
based information to determine whether the 
usage and/or processing of at least a part 
of said database results in said at least one 
budget limit being exceeded: artd 

(iii) based upon said testing step (ij) deter- 
mining that said usage and/or processing 
exceeds said at least one budget limit, 
selectively not enabling or selectively pre- 
venting the usage and/or processing of at 
least a portion of said protected database 
portion. 

1 8. A system according to claim 1 7. wherein said at least 
one budget limit specifies a percentage of said data- 
base and said determining step (ii) determines if the 
usage and/or processing of said at least a part of 
said database results in a specified usage and/or 
processing at least one percentage limit being 
exceeded, and wherein said decoder control logic's 
selectively not enabling or selectively preventing 
means selectively does not enable or selectively 
prevents the use and/or processing of at least a per* 
tion of said database in response to said determining 
step. 

19. A system according to one of claims 17 and 18, 
wherein said database protection arrangement 
(300) contains modem circuitry. 

20. A system according to one of claims 1 7 through 1 9. 
wherein said enclosed, tamper-resistant database 
protection arrangement (300) iscontained within an 
integrated circuit. 

21 . A system according to one of claims 1 7 through 20, 
wherein said database includes first and second dis- 
crete properties, and wherein a first owner owns at 



least one right in a first property and a second owner 
owns at least one right in a second property, wherein 
said system further includes: marketing survey 
means for deriving marketing survey information 
5 from information based on at least a portion of said 
metering. 

22. A system according to one of claims 1 7 through 21 . 
wherein said system further includes embedding 

10 means for embedding, into a copy of at least one 
portion of said database, at least one origin identify 
security code. 

23. A system according to one of claims 1 7 through 22. 
'5 wherein said user is a customer, and wherein said 

database is distributed to said customer by a distrib- 
utor, said system including: 
specifying means enabling the distributor of said 
database to specify a first budget limit, said first 
20 budget limit for use in limiting the use and/or 
processing of at least one portion of said database 
by said customer 

means, for enabling said customer, at said cus- 
tomer's site, to specify a second budget limiting the 
2S use an /or processing of at least a portion of said 
database, sak:! second budget limit used in limiting 
use and/or processing of at least one portion of said 
database by at least one of said customers employ- 
ees. 

30 

2A. A system according to one of claims 17 through 23. 
wherein: 

said decoder control logic means (316) selectively 
does not enable or selectively prevents the use 
3S and/or processing of a subset of said database when 
said testing step (ii) determines that said use and/or 
processingof a subset, in combination with previous 
use and/or processing of database portions, will 
result in sakj budget limit limiting the use and/or 
^ processing of related database information being 
exceeded. 

25. A system according to one of claims 17 through 24, 
wherein said decoder control logic means (316) 

^ selectively does not enable the use and/or process- 
ing of nnore than a certain quantity of contiguous 
database infomnation. 

26. A system according to one of claims 1 7 through 25, 
so wherein said database protection arrangement 

(300) includes display dnving means (514). 

27. A system according to one of claims 1 7 through 26, 
wherein said database protection arrangement 

55 (300) is a dedk:ated browsing workstation (501 ). 
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Pat0ntan«pruche 

1. Verfahren zum Verteilen etner geschutzten Daten- 
bank zur Verwendung durch einen Benutzer. wobei 
das Verfahren die Schritte aufweist: s 

Liefern einer Dalenbank zum Benutzer. wobei 
die Oatenbank wenigstens teilweise verschius- 
selt ist; 

Auswahlen wenigstens eines Teils der Oaten- io 
bank; 

EntschlQssetn wenigstens eines Teiis des (der) 
ausgewahtten Datenbenkabschnittes (-ab- 
schnitte) durch die Verwendung einer Oaten- 
ban kschutzanordnung (300); IS 
Messen wenigstens eines Parameters, der auf 
die Benutzung und/oder Verarbertung wenig- 
stens eines Teils der Oatenbank bezogen ist, 
urn eine MeOinformatkjn zu erzeugen, mittete 
Verwendung der Oatenbankschutzanordnung 20 
(300); 



daduroh 9«k«nnz«tchn«t, daB 

(a) der Lieferschritt die Oatenbank zum Ort des 
Benutzers zum Gebrauch an diesem Ort ant 
etnem Speichermedium (100) tiefert, wobei 
wenigstens ein Teil der Oatenbank durch die 
Datenbankschutzanordnung (300) geschutzt 30 
ist; und durch die folgenden Schritte: 

(b) sicheres Spek:hem wenigstens eines Teils 
der Me3information in einem nicht ftOchtigen 
Speicher am Ort des Benutzers unter Verwen- 
dung der Oatenbankschutzanordnung (300); 35 

(c) sicheres Speichem am Ort des Benutzers 
und durch die Verwendung der Datenbank- 
schutzanordnung (300) einer Budgetinforma- 
tion, die sich daraut bezieht dem Benutzer die 
Benutzung und/oder Verarbeitung wenigstens ^ 
eines Teils der Oatenbank zu ermoglichen 
und/oder den Benutzer am Benutzen und/oder 
Verarbeiten wenigstens eines Teils der Oaten- 
bank zu hindem; 

(d) EmDoglichen, daO der Benutzer wenigstens ^ 
auf einen Teil der gespecherten Benutzungs- 
budgetinformatkxi Zugriff hat; 

(e) Testen am Ort des Benutzers und durch die 
Verwendung der Oatenbankschutzanordnung 
(300) wenigstens eines Teils der gespeicherten so 
MeOinfonnation zum Bestlmmen, ob die Benut- 
zung und/oder die Verarbeitung wenigstens 
eines Teils der Oatenbank zu wenigstens einer 
Budgetgrenze fOhrt die durch die gespeicherte 
BudgetinfornDatk)n angegeben wird, wek:he ss 
uberschritten wird; 

(f) wahlweises Nichtermoglichen oder wahlwei- 
ses Verhindem am Ort des Benutzers durch die 



Verwendung der Datenbankschutzanordnung 
(300) die Benutzung und/oder die Verarbeitung 
wenigstens eines Teils der Oatenbank in Reak- 
tion auf den Testschritt (e), wobei bestimmt wird. 
daQ die Benutzung und/oder Verarbeitung zu 
der wenigstens einen Budgetgrenze tuhrt. die 
uberschritten wird. 

2. Verfahren nach Anspruch 1, daduroh gekenn- 
zelchnett daf) die wenigstens eine Budgetgrenze 
einen Prozentsatz der Oatenbank spezifiztert und 
der Testschritt (e) bestimmt. ob die Benutzung 
und/oder Verarbeitung des wenigstens eines Teils 
der Oatenbank zur speztfizterten Benutzung 
und/oder Verarbeitung wenigstens einer Prozent- 
grenze fOhrt, die uberschritten wird, und wobei der 
wahlweise Ermbglichungs- oder Verhinderungs- 
schritt (f) den Gebrauch und/oder die Verarbeitung 
wenigstens eines Teils der Oatenbank in Reaktion 
auf den Testschritt (e) nrcht ermoglicht oder verhin- 
dert. 

3. Verfahren nach Anspruch 1 oder 2. wobei das Ver- 
fahren das Liefern der Oatenbankschutzanordnung 
(300) zum Benutzer innerhalb wenigstens einer inte- 
gherten Schattung enthatt, wobei die Datenbank- 
schutzanordnung (300) eine Spezialzweck-, pro- 
grammierbare, verfalschungssichere integrierfe 
Schaltungsanordnung enthatt, wobei die integnerfe 
Schaltungsanordnung wenigstens teitweise gegen 
eine unberechtigte Benutzung und/oder Verarbei- 
tung wenigstens eines Teils der Oatenbank Sicher- 
heit bietet; und wobei das Verfahren femer die 
Schritte enthatt: 

(a) Spek:hem wenigstens etne der PaOworftn- 
formatkxi und Benutzerkjentifikatbnsinfor- 
matkyt in einer nicht fluchtigen Speicheranord- 
nung innerhalb der integrierfen Schaltungsan- 
ordnung; 

(b) Ourchfuhren wenigstens eines Teils des 
Messens innerhalb der integrierten Schaltungs- 
anordnung; 

(c) Speichern wenigstens eines Teils der MeOin- 
fonmatk)n in der nk;ht fluchtigen Spek;heranord- 
nung innerhalb der integrierten Schaltungsan- 
ordnung; und 

(d) OurchfQhren wenigstens eines Teitsdes Ent- 
schlusselungsschritts innerhalb der integrierten 
Schaltungsanordnung. 

4. Verfahren nach Anspaich 3, wobei das Verfahren 
femer das Speichem einer Abrechnungsinformation 
innerhalb der integrierfen Schaltungsanordnung 
enthalt wobei wenigstens ein Teil der Abrechnungs- 
informatwn auf der Basis wenigstens eines Teils der 
erzeugten MeSinfornrration und wenigstens eines 
vorbestimmten Abrechnungspreises berechnet 
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wird. 

5. Verfahren nach einam der Anspruche 3 und 4. wobei 
die integrierte Schattungsanordnung eine Modem- 
schaitung enthalt und das Verfahren ferner das 5 
Ubertragen von Information zu einem entfernten Ort 
wenigstens teilweise durch die Verwendung der 
Modemschaltung enthalt. 

6. Verfahren nach einem der Anspruche l bis 5, wobei 
der selektive Nichtermogtichungs- Oder setektive 
Verhinderungsschritt (f) In Reaktion auf den Test- 
schritt (e) die Benutzung der Datenbank fur einen 
ersten Tail der Datenbank mit einem Einheitspreis 
ertaubt, und fur einen zweiten Teif der Datenbank; '5 
der vom ersten Teil der Datenbank verschieden ist, 

die Benutzung und/oder Verarbeitung auf der Basis 
etner Rechnungssteitung ertaubt. wobei die Kosten 
der Benutzung das zweiten Teils am Ort des Benut- 
zers unter Verwendung wenigstens eines Teils der 20 
MeBinfomiatton berechnet werden. 

7. Verfahren nach einem der Anspruche 1 bis 6. wober 
der Schritt des sicheren Speichems (e) das Spei- 
chem wenigstens eines Teils der MeBinformation in 2$ 
einem ibsbaren Spechermodut enthalt. das wir- 
kungsmafJIg mit der Datenbankschutianordnung 
(300) verbunden und von dieser Idsbar ist; und 
wobei das Verfahren femer die Schritte enthalt: 

30 

Losen des losbaren Speichermoduls; und 
Venwenden der im gek)sten Speichermodul ge- 
speicherten Oaten fur den Zweck. eine Benut- 
zungshistorie fOr den Benutzer zu bestimmen. 

35 

8. Verfahren nach einem der Anspruche 1 bis 7, 
dadurch g^ksnnnlohnat, da3 der Benutzer ein 
Kunde ist und das Verfahren femer das Spezifizie* 
ren wenigstens eines Teils der gespeicherten Bud- 
getinformatkxi durch den Kunden und am Ort des ^ 
Kunden enthdtt. wobei die kundenspezrfizierfe Bud- 
getinformation wenigstens eine Qrenze fur die 
Benutzung und/oder der Verarteitung wenigstens 
eines Teils der Oatenbasis durch wenigstens einen 
der Angestellten des Kunden spezifiziert. ^ 

9. Verfahren nach einem der Anspruche 1 bis 8. 
dadurch gakannzaiohnet. daO die Datenbank 
mehrere diskrete Eigenschaften aufweist. und 
wobei ein erster EigentOmer wenigstens ein Recht so 
an einer ersten Eigenschaft und ein zweiter Eigen- 
tOmer wenigstens ein Recht an einer zweiten Eigen- 
schaft besitzt, und wobei es sich beim Benutzer um 
eine Organisation mit Angesteltten handett, wobei 
das Verfahren femer die Schritte enthalt 55 

Ermdglichen, da6 die Organisation wenigstens 
einen Teil der Begrenzungsinformation einrich- 



let, indem eine Begrenzung fur die Benutzung 
und/oder Verarbeitung wenigstens eines Teils 
der vielerlei diskreten Eigenschaften durch we- 
nigstens einen Angestellten der Organisation 
spezifiziert wird; 

Ermdglichen, da3 ein Veroffentlicher wenig- 
stens einen Teil der Begrenzungsinformation 
spezifiziert; und 

wobei der selektive Nichtermoglichungs- Oder 
selektive Verhinderungsschritt (f) das wahlwei- 
se Nichtermdglk^hen oder wahlwetse Verhin- 
dern der Benutzung und/oder Verarbeitung we- 
nigstens eines Teils einer Datenbank enthatt, 
die wenigstens zum Tail auf der von der Orga- 
nisation spezifiziert en und/oder dem Veroffent- 
licher spezifizierten Begrenzungsinformalkjn 
basiert. 

10. Verfahren nach einem der Anspruche 1 bis 9. wobei 
das Verfahren ferner das Verarbeiten wenigstens 
eines Teils der Meflinformation enthalt, um eine 
Marktubersichtsinfomrtation zu erzeugen. 

11. Verfahren nach einem der Anspruche 1 bis 7 und 
10. wobei es sich beim Benutzer um eine Organisa- 
tion mit Angestellten handelt. wobei das Verfahren 
femer den Schritt enthatt, da6 die Organisation auf 
einer Seite der Organisation wehlgstens einen Teil 
der Budgetinformation spezifizieren kann, wobei die 
von der Organisation spezifizie rte Budgetinforma- 
tion wenigstens ein Budget zum Begrenzen der 
Quant itat wenigstens einer Untermenge des Oaten- 
bankinhalts einrichtet. die von wenigstens einem der 
Angestellten der Organisation benutzt und/oder ver- 
arfoertet wird; wobei der selektive Nichtermogli- 
chungs- Oder Verfiinderungsschrrtt (f) wahlweise die 
Benutzung und/oder Verarbeitung wenigstens eines 
Teils der Datenbank wahlweise nicht ermoglkrht 
Oder wahlweise verhindert, wobei dies wenigstens 
teilweise auf dem von der Organisation spezifizier- 
ten Budget basiert. 

12. Verfahren nach einem der Anspruche 1 bis 11, 
wobei es sich beim Benutzer um eine Organisation 
handelt und wobei die Me^information wenigstens 
teilweise aus dem Messen auf der Basis von meh- 
reren Goippen von Benutzem innerhalb der Orga- 
nisatkyi resultiert; wobei das Verfahren ferner das 
Versorgen der Organisation mit wenigstens einem 
Teil der gotppenbezogenen MeDinformation enthatt. 

13. Verfahren nach einem der Anspruche 1 bis 12, das 
femer den Schritt dee Herstellens einer Kopie 
wenigstens eines Teils der Datenbank enthatt, 
wobei der Kopierschritt das Vorsehen wenigstens 
eines etngebetteten Kopierursprungsidentifikati- 
onscodes in der Kopie enthatt. 
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14. Verfahren nach einem der Anspruche 1 brs 13. das 
femer den Schritt enthalt, dem Benutzer die brtliche 
Suche in der Datenbank zu ermbglichen, um Oaten- 
ban kteile zu identifizieren, welche wenigstens tell- 
weise eine aktuelle Boziehung zu den vom Benutzer s 
spezifizierten Versuchskriterien haben. 

15. Verfahren nach einem der Anspruche 1 bis 14, 
wobei die Budgetintormation wenigstens eine 
Grenze fur die kumulative Benutzung und/oder Ver- io 
arbeitung von logisch verbundenen Teilen der 
Datenbank enthatt, urxj wobei das Verfahzren femer 
den Schritt enthalt: 

(a) Bestimmen, ob die Benutzung und/oder Ver- is 
arbeitung wenigstens eines Datenbankteils in 
Vertoindung mrt der Benutzung und/bder Verar- 
beitung von Datenbankteilen. die vom Benutzer 
vorher benutzt und/oder verarbeitet wurden, 
eine Grenze ubersteigt, die von der Begren- so 
zungsinformatk)n fur die Benutzung und/oder 
Verarbeitung der Oatenbankteite spezifiziert 
wird, die eine gewisse k)gi$che Beziehung aut^ 
weisen; 

(b) wobei der setektive Nk^htermbglk^hungs- 2S 
Oder setektive Verhinderungsschritt (f) waht- 
weise die Benutzung uncV Oder Verarbeitung 
wenigstens eines Teils des wenigstens einen 
Datenbankteils in Reaktk}n auf den Testschritt 

(e) wahlweise nk;ht ermoglicht Oder wahlweise 30 
verhindert, der zeigt. da(3 eine Datenbankbe- 
nutzung und/oder Verartoeitung wenigstens 
eine Grenze fur die Benutzung und/oder Verar- 
beitung der Datenbankteile ubersteigt, die eine 
gewisse logische Beziehung auf weisen. 3S 

16. Verfahren nach einem der Verfahren 1 bis 1 5, wobei 
der selektfve Nichternnoglichungs- oder Verhinde- 
rungsschritt (f) die Benutzung und/oder Verarbet- 
tung von mehr als einer gewissen Menge der 40 
benachbarten Datenbankinformatk)n wahlweise 
nicht ermoglicht Oder wahlweise verhindert. 

17. System zum Verteilen eines geschOtzten. gespei- 
cherten, digftateodierten Datenbankteils, wobei das 
System ein Speichermedium (100) zum Spek:hem 
wenigstens einer Datenbank am Ort des Benutzers 
zur Venwendung durch den Benutzer enthatt, wobei 
die Datenbank wenigstens teitweise gegen unbe- 
rechtigte Benutzung und/oder Verarbeitung so 
geschQtzt ist; gek«nnz«lchn«t duroh eine Spezi- 
aizweck-, verfalschung88k:here. etngeschlossene 
Datenbankschutzanordnung (300). die am Ort des 
Benutzers angeordnet ist, wobei die Datenbank- 
schutzanordnung geeignet ist, gegen unberechtigte ss 
Benutzung und/oder Verarbeitung der Datenbank 
(en) ein Sichem vorzunehmen, wobei das Skrhem 
das sichere Messen wenigstens eines Parameters 



enthalt. der zu wenigstens etnem der Vorgange Ver- 
arbeiten und Benutzen wenigstens etnes Teils der 
Datenbank gehdrt. wobei die Datenbankschutzan- 
ordnung (300) aufweist; 

(a) einen nichtfluchtigen Speicher (31 4) zur Ver- 
wendung beim sicheren Speichem der Budget- 
information, wobei wenigstens eine Budget- 
grenze eingerichtet wtrd. die sich auf die Benut- 
zung und/oder Verarbeitung wenigstens eines 
Teils der Datenbank(en) durch den Benutzer 
bezieht, wobei der nichtfluchtige Speicher (314) 
ebenso geeignet ist fOr: 

(i) sicheres Speichem einer Information, 
die auf wenigstens einem Teil des Daten- 
bankmessens basiert. 

(ii) Speichem etner Abrechnungspreisinfor- 
mation, und 

(iii) Abspeichem einer lnformatk>n auf der 
Basis des Berechnens wenigstens eines 
Teils der Kosten fOr die Benutzung 
und/oder Verarbeitung wenigstens eines 
Teils der Datenbank(en) durch den Benut- 
zer und 

(b) eine Decodiersteuerkagikanordnung (316). 
die geeignet ist fur 

(i) das stchere Messen wenigstens eines 
Parameters, der sich auf wenigstens einen 
der Vorgange Verarbeiten und Benutzen 
wenigstens eines Teils der Datenbank 
bezieht; 

(ii) SKheres Testen der auf dem Messen 
basierenden gespeicherten Information, 
um zu bestimmen. ob die Benutzung 
und/oder Verarbeitung wenigstens eines 
Teils der Datenbank zu wenigstens einer 
Budgetgrenze fuhrt, die uberschritten wird; 
und 

(tit) wahtweises Nichtermoglichen oder 
wahlweises Verhindern der Benutzung 
und/oder Verarbeitung wenigstens eines 
Teils des geechutzten Datenbankteils wenn 
auf der Basis des Testschhtts (ii) bestimmt 
wird, daO die Benutzung und/oder Verar- 
beitung die wenigstens eine Budgetgrenze 
ubersteigt. 

18. System nach Anspruch 17, wobei die wenigstens 
eine Budgetgrenze einen Prozentsatz der Daten- 
bank spezifiziert und der Bestimmungsschritt (ii) 
bestimmt. wenn die Benutzung und/oder Verarbei- 
tung des wenigstens eines Teils der Datenbank zu 
einer spezifizierten Benutzung und/oder Verarbei- 
tung bei wenigstens einer Prozentsatzgrenze fuhrt, 
die uberschritten wird, und wobei die selektive 
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Nichtermoglichungs- Oder selektive Verhinderungs- 
einnchtung der Decodiersteuerlogik die BenuUung 
und/oder Verarbeitung des wenigstens eines Tails 
der Datenbank in Reaktlon auf den Bestimmungs- 
schrttt wahlweise nicht ermoglkih Oder wahlweise s 
vertiindart. 

19. System nach einem der Anspruche 17 und 18, 
wobei die Datenbankschutzanordnung (300) eine 
Modennschaltung umfaQt. io 

20. System nach einem der Anspruche 1 7 bis 1 9. wobei 
die eingeschlossene verfalschungssichere Daten- 
bankschutzanordnung (300) innerhalb einer inte- 
grierten Schattung enthatten ist is 

21. System nach etnemder Anspruche 17 bis 20, wobei 
die Datenbank erste und zweite diskrete Eigerv^ 
schaften aufweist. und wobei ein erster EigehtOmer 
wenigstens ein Recht an einer ersten Eigenschaft 20 
und ein zweiter Eigentumer wenigstens ein Recht 

an einer zwerten Ergenschafr besftzt. wobei daa 
System femer aufweist: 

eine MarketingubersKhtseinhchtung zum Ableiten 
einer Marketingubersichtsinformatkm von der Intor- 2S 
mation. die auf wenigstens einem Teit der Messung 
bastert. 

22. System nach einem der AnsprOche 1 7 bis 21 , wobei 
das System f erner eine E inbetteinrichtung zum Ein- 30 
betten wenigstens eines originalen Identifizierungs- 
sk:herhertscodes in eine Kopie von wenigstens 
einem Teil der Datenbank aufweist. 

23. System nach einem der AnsprOche 17 bis 22, wobei 3S 
der Benutzer ein Kunde ist und wobei die Datenbank 
uber einen Verteiler an den Kunden verteitt wird, 
wobei das System aufweist 

eine Spezifizierungseinrichtung, die es ermog- ^o 
licht, daf) der Verteiler der Datenbank eine erste 
Budgetgrenze spaziflziert, wobei die erste Bud- 
getgrenze zum Begrenzen der Benutzung 
und/oder Verarbeitung von wenigstens einem 
Teil der Datenbank durch den Kunden verwen- 4S 
det wird; 

eine Etnrichtung, die es dem Kunden emibg- 
ticht. auf der Kundenseite ein zweites Budget zu 
spezifizieren, welches die Benutzung und/oder 
Verarbeitung von wenigstens einem Teil der Da- so 
tenbank begrenzt, wobei die zweite Budget- 
grenze zum Begrenzen der Benutzung und/ 
Oder Verarbeitung wenigstens eines Teils der 
Datenbank von wenigstens einem der Kunden- 
angesteltten verwendet wird. ss 

24. System nach einem der Anspruche 1 7 bis 23, wobei: 
die Decodter8teuerlogikeinrk:htung (316) die Benut- 



zung und/oder Verarbeitung einer Untermenge der 
Datenbank wahlweise ntcht ermdglicht oder wahl- 
weise verhindert, wenn der Testschnn (ii) bestimmt. 
daf3 die Benutzung und/oder Verarbeitung etner 
Untermenge in Kombination mit der vorhergohen- 
den Benutzung und/oder Verarbeitung der Daten- 
bankteile zu der die Benutzung und/oder Verarbei- 
tung einer Bezugsdatenbankinformation begren- 
zenden Budgetgrenze fuhrt, die uberschritten wird. 

25. System nach einem der AnsprOche 1 7 bis 24. wobei 
die Decodiersteuerlogikeinrichtung (316) wahlweise 
die Benutzung und/oder Verarbeitung von mehr als 
einer bestimmten Menge von benachbarten Daien- 
bankinformationen nicht ermdglicht. 

26. System nach einem der Anspruche 1 7 bis 25. wobei 
die Datenbankschutzanordnung (300) eine Display- 
treibereinrichtung (514) enthalt. 

27. System nach einem der /Vnspruche 1 7 bis 26. wobei 
die Datenbankschutzanordnung (300) eme uberlas- 
sene Uberprutungs-Workstation (501 ) ist. 

Revendtcatione 

1 . Proc^ de distribution d'une base de donndes pro- 
t^gde. pour utilisation par un uttlisateur, (edit pro- 
c66^ comportant les stapes consistant ^ : 

foumir une base de donndes audit utilisateur, la- 
dite base de donndes dtant au moins partielle- 
ment cryptde; 

s^lectionner au moins une partie de ladite base 
de donndes; 

par TtntermMiaire de t'uttlisation d'un agence- 
ment (300) de protecton de la base de don- 
ndes, dterypter au moins une partie de ladite 
ou desdrtes parties sdlectkxindes de fa base de 
donndes; 

par rintemnddiaire de I'utilisation dudit agence- 
ment (300) de protection de ta base de don- 
ndes, compter au moins un param6tre 114 A I'uti- 
tisatkxi et/ou au traitement d'au moins une par- 
tie de ladite base de donndes, pour produire une 
informatkxi de comptage; 
caractdrisd en ce que 

(a) ladite 4tape de fourniture foumit ladite base 
de donn^es sur ledit site d'utilisateur pour utili- 
satkyi sur ledit site, sur un support de stockage 
(100). au moins une partie de ladite base de 
donndes dtant protdg^e par ledit agencement 
(300) de protection de la base de donnas; et 
par les dtapes ci-dessous : 

(b) par rinterm^iaire de Tutilisation dudit agen- 
cement (300) de protection de la base de don- 
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ndes, stocker d© manidre sure dans une 
m6moire non volatile, sur ledit site d'utilisateur, 
au moins une partte de ladite information de 
comptage; 

(c) par rinterm^diaire de I'utilisatlon dudit agen- 
cement (300) de protection de la base de don- 
n6es, stocker de mani^re sure sur ledit site d'uti- 
lisateur des informations de budget permettant 
audit utiMsateur d'utiliser et/ou de traiter au 
motns une partie de ladite base de donn6es 
et/ou empdcher ledit utilisateur d'utiliser et/ou 
de traiter au moine une partie de ladite base de 
donn^es; 

(d) permettre audit utilisateur d'accMer k au 
moins une partie de ladite information de budget 
d'utilisation stockde; 

(e) sur ledit site d'utilisateur, par I'interm^diaire 
de rutilisation dudit agencement (3CX3) de pro- 
tection de la base de donndes, verifier au moins 
une partie de ladite informatkxi de comptage 
stockde, pour determiner si rutilisation et/ou le 
traitement d'au moins une partie de ladite base 
de donndes entraine le d^passement d'au 
rTH3tns une limite de budget indk^u^e par ladite 
information de budget stockde: 

(f) par I'intermMiaire de rutilisation dudrt agen- 
cement (300) de protectkxi de la base de don- 
ndes, ne pas autoriser de mani^e selective ou 
interdire de manidre selective rutilisation et/ou 
le traitement d'au moins une partte de ladite 
base de donndes sur ledit site d'utilisateur. en 
r^ponse k une situation ou ladite dtape de vdri- 
ficatksn (e) a determine que ladite utilisatksn 
et/ou ledit traitement entraTnent le ddplacement 
de ladite limite de budget au motns exietante, 

Proc^d selon la revendk^tkxi 1, caractdrlsd en 
outre en ce que ladite limite de budget au moins 
existante spteifie un pourcentage de ladite base de 
donndes, et ladite dtape de vdrrfication (e) deter- 
mine si rutilisation et/ou le traitement de ladite partie 
au HDoins existante de ladite base de donndes 
entraTne le ddpassement de ladite utilisation spdci- 
Ua et/ou dudit traitement specific d'au moins une 
limite de pourcentage, et dans lequel tadtte etape 
d'autorisation ou d'tnterdictnn selective (f) n'auto- 
rise pas ou interdit futilisatkxi et/ou le traitement 
d'au moins une partie de ladite base de donndes en 
rdponse d ladite dtape de vdrificatk)n (e). 

Proc^dd seton la revendicatkyi 1 ou 2. dans lequel 
ledit procede comporte la foumiture audit utilisateur 
dudit agencement (300) de protection de la base de 
donndes dans au moins un circuit intdgrd, tandis que 
ledit agencement (300) de protectkxi de la base de 
donndes comporte un agencement de circuit intdgrd 
k usage special, programmable, resistant aux ten- 
tatives d'effractton. ledit agencement k circuit tnte- 
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gre assurant au moins en partie une protection cen- 
tre une utilisation et/ou un traitement non autonses 
d'au moins une partte de ladite base de donnees; et 
ledit proc6de comporte. en outre, les etapes 
consistant d : 

(a) dans un agencement d mdmoire non volatile 
situ6e dans ledit agencement ^ circuit intdgre, 
stocker au moins une information de mot de 
passe ou une information d'identification d'utili- 
sateur; 

(b) effectuer au moins une partie dudit comp- 
tage dans ledit agencement ^ circuit integr6; 

(c) dans ledit agencement d memoire non vola- 
tile situe dans ledit agencement k circuit integre. 

" stocker au moins une partie de ladite informa- 
tion de comptage; et 

(d) effectuer au moins en partie ladite etape de 
decryptage dans ledit agencement k circuit inte- 

gre. 

Procede sekDn la revend»catk)n 3, dans lequel ledit 
precede comporte, en outre, le stockage d'une infor- 
mation de facturation dans ledit agencement k cir- 
cuit integre, au moins une partie de ladite informa- 
tk>n de facturatkxi etant cak:uiee sur base d'au 
moins une partie de ladite information de comptage 
produite et d'au moins un taux predetermine de fac- 
turation. 

Procede sekxi I'une des revendications 3 et 4, dans 
lequel ledit agencement ^ circuit integre comporte 
un circuit k modem, et ledit procede comporte. on 
outre, la communk:ation d'Informations vers un site 
etoigne, au moins en partie par I'intermediaire de 
rutilisation dudit circuit d modem. 

Procede sekxi Tune des revendications 1 k 5, dans 
lequel ladite etape (f) de non-autortsatron selective 
ou d'interdictkxi selective comprend. en reponse k 
ladite etape de verificatbn (e), I'autorisation d'utili- 
satkxi de la base de donn6es pour un fortatt fixe pour 
au moins une partie de ladite base de donnees, et 
pour une seconde partie de ladite base de donnees 
qui est differente de ladite premiere partie de la base 
de donnees, i'autorisatkxi d'une facturatkjn basee 
sur rutilisatk^n et/ou le traitement, dans lequel le 
coOt de rutiltsatkxi de la seconde partie est calcuie 
sur ledit site d'utilisateur en recourant au moins d 
une partie de ladite information de comptage. 

Procede seton Tune des revendicatksns 1 k 6, dans 
lequel ladite etape (e) de stockage sOre comprend 
le stockage d'au moins une partie de ladite informa- 
tton de comptage dans un module memoire deta- 
chable relie fonctionnellement audit agencement 
(300) de protection de ta base de donnees et pou- 
vant en dtre detache; et ledit procede comporte. en 
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outre, les etapes consistant k : 

detacher ledit module mdmoire detachable; et 
utiliser les donndes stock^es dans ledit module 
m^moire detachable en vue de determiner un histo* 
rique de Tutilisation par ledit utiltsateur 5 

8. Proc6d6 selon Tune des revendicaticns 1 ^ 7, carac- 
terisd, en outre, en ce que ledrt utilisateur est un 
client et ledit procedd compcrte en outre la specifi- 
cation, par ledit client et si;r ledrt site du client, d'au *^ 
moins une partie de ladite information de budget 
stockee. ladite information de budget specifiee par 

le client specif iant au moms une Itmite d'utilisatk^n 
et/ou de traitement d'au moins une partis de tadite 
base de donnees par au moins un des emptoyes i^ 
dudit client. 

9. Precede selon Tune des revendicaticns 1 ^8, carac- 
terise, en outre, en ce que ladite base de donnees 
comprend plusieurs proprtetes distinctee, at dans 
lequet un premier proprietaire possMe au morns urr 
droit sur une premiere propriete et un second pro- 
prietaire possdde au moins un droit sur une seconde 
propriete. et dans lequel ledit utilisateur est une . 
organisation ayant des emptoyes;, ledit precede ^ 
comportant. en outre, les etapes consistant d : v 

permettre ^ ladits organisation d'^ablir et^ 
moins une partie de ladrte informatnn da limrtatkxi 
en specifiant une limite d'utilisatlon et/ou de traite- 
ment d'au moins une partie desdites drfferentes pro- 30 
prietes distinctes par au moins un employe de ladite 
organisation; 

permettre ^ un editeur de specifier au moins 
une partie de tadite information de limitation; et 

dans lequel ladite etape (f) de non-autorisation 3S 
selective ou d'interdiction selective comprend la 
non-autorisation selective ou )'interdk;tion selective 
de rutittsatk)n et/ou du traitement d'au moins une 
partie d'une base de donnees. basees au moins en 
partie, sur rinforoBtlon de limitatkxi specifiee par 40 
ladite organisation et/ou specifiee par tedit editeur. 

10. Procede sekxi I'une des revendk:ations 1 k 9, dans 
lequel ledit procede comports, en outre, le traite- 
ment d'au moins une partie de ladite information de ^ 
comptage pour foumir une information de suivi du 
marche. 

11. Procede selon Tune des revendicaticns 1 ^ 7 et la 
revendicatkxi 1 0. dans lequel tedit utilisateur est une so 
organisation qui a des employes, ledit precede com- 
portant, en outre, retape consistant k permettre k 
ladite organisation de specifier, sur un site de I'orga- 
nisation, au moins une partie de ladite infcrmatksn 

de budget, ladite informatkx) de budget specific par 
I'organisatk^n etabiissant au moins un budget pour 
limiter la quantite d'au moins un sous-ensemble du 
contenu de ladrte base de donnees, qui peut dtre 



utilise et/ou traite par au moms un desdits employes 
de ladite organisation; 

ladite etape (t) de non-autorisation selective 
ou d'interdiction selective n'autonsant pas de 
maniere selective ou interdisant de manidre selec- 
tive t'utilisation et/ou le traitement d'au moins une 
partie de ladite base de donnees, sur base, au moins 
en partie, du budget specifie par ladite organisation. 

12; Procede selon I'une des revendicaticns 1^11. dans 
lequel ledit utilisateur est une organisation, et dans 
lequel tadite information de comptage resulte au 
moins en partie d'un comptage base sur plusieurs 
groupes d'utilisateurs appartenant k ladite organisa- 
tion; 

ledit precede comportant. en outre, la foumi- 
ture k tiadite organisation d'au moins une partie de 
- rinfonmatkyi de comptage liee audit greupe. 

13. Precede selon Tune des revendicaticns 1^12. com- 
portant en outre, retape consistant k realiser une 
copie d'au nrKsins une partie de ladite base de don- 
nees. dens lequel tadite etape de copie compcrte la 
foumiture dans tadite copie d'au moins un code inte- 
gre identrfiant Tehgine de la copie. 

14 Procede sekxi I'une des revendicaticns ^k^2. com- 
portant. en outre, retape consistant k permettre 
audit utilisateur d' examiner ladite base de donnees 
sujet par sujet. pour identifier des parties de la base 
de donnees dent le sujet presente une relation au 
moinspartietle avec des criteres de recherche spe- 
ciftSspar I'utilisateur 

1 5. Precede selon I'une des revendicaticns 1^14, dans 
lequel ladrte infonnation de budget comprend au 
moins une limitation sur une utilisation cumulative 
et/ou un traitement cumutatif de parties tcgiquement 
retiees de ladrte base de donnees, et dans lequel 
ledit procede compcrte. en outre, retape consistant 
k: 

(a) determiner si I'utilisation et/ou le traitement 
d'au moins une partie de la base de donnees, 
en combinaison avec Tutilisation et/ou le traite- 
ment de parties de ta base de donnees preata- 
blement utilisees et/ou traitees par tedit utilisa- 
teur. depasseront une limite specifiee par ladite 
informatkxi de limitatksn de t'utilisation et/ou du 
traitement de parties de la base de donnees qui 
presentent une certaine relation Icgique; 

(b) iadite^tape (f) de non-autorisation selective 
ou d'interdiction selective n'autorisant pas de 
manidre selective ou interdisant de maniere 
selective Tutilisation et/ou le traitement d'au 
moins une partie de tadite panie au moins exis- 
tante de la base de donnees, en reponse k une 
situation ou ladite etape de verification (e) 
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r^vdle qu'une utilisation et/ou un traitement de 
la base de donnas ddpassent au molns une 
limitation k rutilisation et/ou au traitement de 
parties de la base de donn^es qui pr^santent 
une certaine relation logique. s 

16. Proc6d6 selon I'unedes revendications 1^15, dans 
lequel ladite dtape (f) de non-autorisation selective 
ou d'interdiction selective n'autorise pas de manidre 
selective ou interdit de manidre sdlecttvo rutilisation io 
et/ou le traitement de plus d'une certaine quantity 
d'tnformattons contigues de la base de donn^es. 

17. Systdme de distribution vers un utilisateur d'une par^ 

tie protdgde, stock^e, num^riquement cod^e, d'une ^ - is 
base de donndes. ledit systdme comprenant un sup- 
port de stockage (100) pour stocker sur ledit site 
d'utiiisateur au moins une base de donndes. pour 
utilisation par ledit utillsateur, ladite base de don- 
ndes dtant au moins partieilement protdgde contre 20 
une utilisation et/ou un traitement non aUoris^; 
caract6risd par ' 
un agencement (300) de protection de la base 
de donndes, ^ usage spteial. resistant aux tentath 
ves d'etfractkDn. fermd. situd sur un site d'utiiisateur. 2S 
ledit agencement (300) de protection de la base da 
donntos dtant adaptd pour assurer une protection: 
contre une utilisation et/ou un traitement non auto- 
risds desdites bases de donndes, ladite protectksn 
comprenant le comptage sur d'au moins un paramd- ^ 
tre concemant au moins le traitement ou au moins 
I'utilisation d'au moins une partie de ladite base de 
donn^es. ledit agencement (300) de protectk)n de 
la base de donndes comportant : (a) une mdmoire 
non volatile (314) destinde k dtre utilisde pour le 3S 
stockage sur d'infonmatkxis de budget dtabltssant 
au moins une limite de budget lide d I'utilisation et/ou 
le traitement par Tutiltsateur d'au moins une partie 
desdites bases de donndes. ladite mdnDoire non 
volatile (314^ dtant dgalement adaptde pour : 40 

(i) stocker de manidre sure une informatran 
bas4e sur au nnoins une partie dudit comptage 
de la base de donndes, 

(ii) stocker dee informations de taux de factura- 4s 
tion, et 

(iii) stocker une information bas^ sur le calcut 
d'au moins une partie du coOt de I'utilisaton 
et/ou du traitement par I'utilisateur d'au nnoins 
une partie desdites bases de donndes; et so 

(b) un agencement de togk^ue de commande (316) 
du dteodeur. adaptd pour : 

(i) ledit comptage 9ur d'au moins un paramdtre ss 
concernant au moins le traitement ou au moins 
I'utilisatksn d'au moins une partie de ladite base 
de donndes; 



(ii) la verifk:ation sure de ladite information stoc- 
kee bas6e sur le comptage. pour d6terminer si 
rutilisation et/ou le traitement d'au moms une 
partie de ladite base de donndes entrain e le 
ddpassement de ladite limite de budget au 
moins existante; et 

(iii) sur base de ladite dtape de verification (ii) 
determinant si ladite utilisation et/ou ledit traite- 
ment depassent ladite limite de budget au 
moins existante, ne pas autoriser de mani6re 
selective ou interdire de manidre selective I'uti- 
lisation et/ou le traitement d'au moins une partie 
de ladite partie protegee de la base de donnees 

18. Systeme seton la revendication 17, dans lequel au 
moins une limite de budget specifie un pourcentage 
de ladite base de donn6es, et ladite etape de deter- 
mination (ii) determine si I'utilisation et/ou le traite- 
ment de ladite partie au moins existante de ladite 
base de donnees entraine lors d'une utilisation et/ou 
d'un traitement specifies le d6passement d'au moins 
une Nnwte de pourcentage, et dans iequel le moyen 
de non-autorisatkxi selective ou d'interdk:tion selec- 
tive de la togk^ue de commande du decodeur n'auto- 
rise pas de manidre selective ou interdit de manidre 
selective I'utilisation et/ou te traitement d'au moins 
une partie de ladito base de donnees. en reponse ^ 
ladite etape de determination. 

19. Systeme seton I'une des revendicatrans 17 et 18. 
dans lequel ledit agencement (300) de protection de 
la base de donnees contient un circuit ^ modem. 

20. Systeme selon I'une des revendications 17 d 19, 
dans lequel ledit agencement (XO) de protectkjn de 
la base de donnees, ferme et resistant aux tentati- 
ves d'extraction est contenu dans un circuit integre. 

21. Systeme selon I'une des revendications 17 ^ 20, 
dans lequel ladite base de donnees comprend une 
premiere et une seconde propriete, distinctes. et 
dans lequel un premier proprietaire possede au 
moins un droit sur une premiere propriete et un 
second proprietaire possede au moins un droit sur 
une seconde propriete, lequel systeme comprend 
en outre : 

un moyen de suivi du marche pour deduire des 
informatkxis de suivi du marche k partir d'informa- 
ttons basees sur au moins une partie dudit comp- 
tage. 

22. Systeme selon I'une des revendications 17 ^ 21, 
dans lequel ledit systeme comprend. en outre, un 
moyen d'incorporatkxi. pour incorporer dans une 
copie d'au moins une partie de ladite base de don- 
nees au moins un code de securite identiftant I'ori- 
gine. 
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23. Systdme selon I'une des revendications 17 ^ 22, 
dans lequel ledit utilisateur est un client, et dans 
lequel ladite base de donn^es est distribute audit 
client par un distributeur, ledit systdme comprenant : 

un moyen de specification pemnettant au dis- s 
tributeur de ladite base dedonntes de specifier une 
premiere limrte de budget, ladite premidre Itmite de 
budget etant utilisde pour limiter rutilisation et/ou le 
traitement d'au moins une partie de ladite base de 
donndes par ledit client; w 

un moyen pour permettre audit client, sur le 
site dudit client, de specifier un second budget limi- 
tant rutilisation et/ou le traitement d'au moins une 
partie de ladite base de donnees. ladite seconde 
limite de budget etant utitisee pour limiter rutilisation is 
et/ou le traitement d'au nrvsins une partie de tadite 
base de donnees par au moins un des employes 
dudit client 

24. Systeme selon i'une des revendications 17 ^ 23, 20 
dans lequel : 

ledit moyen de logique de commande (316) du 
decodeur n'autortse pas de maniere selective ou 
interdit de maniere selective rutilisation et/ou la trai- 
tement d'un sous-ensemble de ladite base de don- 2s 
nees lorsque tadite etape de verification (ii) deter- 
mine que ladite utilisation et/ou ledit traitement d'un 
sous-ensemble, en combinaison avec une utilisa- 
tion et/ou uri traitement anterieurs de parties de fa 
base de donnees. entralneront le depassement de 30 
ladite limite de budget limitant rutilisation et/ou te 
traitement d'intormations concemees presentee de 
la base de donnees. 



25. Systems selon I'une des revendications 17 ^ 24, 3S 
dans lequel ledit nnoyen de logique de commande 
(316) du decodeur n'autorise pas de maniere selec- 
tive rutilisation et/ou le traitement de plus d'une cer- 
taine quantite d'intormations contigues de la base 

de donnees. 40 

26. Systeme selon I'une des revendications 17 ^ 25. 
dans lequel ledit agencement (300) de protection de 
la base de donnees comprend un moyen (514) -de 
commande d'affichage. 45 



27. Systems selon I'une des revendications 17 ^ 26, 
dans lequel ledit agencement (300) de protection de 
la base de donnees est un poste de consultation 
(501 ) specifique. so 
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